From 756d436a2f1e863ba4e302ef3c3be0568dc7540f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pedro=20Mart=C3=ADn?= Date: Tue, 21 Oct 2025 03:16:05 +0200 Subject: [PATCH] feat(compliance): improve CCC catalogs (#8944) --- prowler/compliance/aws/ccc_aws.json | 2754 ++++------------------ prowler/compliance/azure/ccc_azure.json | 2789 ++++------------------- prowler/compliance/gcp/ccc_gcp.json | 2766 ++++------------------ 3 files changed, 1182 insertions(+), 7127 deletions(-) diff --git a/prowler/compliance/aws/ccc_aws.json b/prowler/compliance/aws/ccc_aws.json index ba00424a72..1f6da6d5f6 100644 --- a/prowler/compliance/aws/ccc_aws.json +++ b/prowler/compliance/aws/ccc_aws.json @@ -6,19 +6,19 @@ "Description": "Common Cloud Controls Catalog (CCC) for AWS", "Requirements": [ { - "Id": "CCC.AuditLog.C01.TR01", + "Id": "CCC.AuditLog.CN01.AR01", "Description": "When the signature validation process is performed, then it MUST detect any modification of data.", "Attributes": [ { "FamilyName": "Integrity", "FamilyDescription": "Controls designed to protected the integrity of Audit Log data.", - "Section": "CCC.AuditLog.C01 Implement Digital Signatures With Hash Chaining", + "Section": "CCC.AuditLog.CN01 Implement Digital Signatures With Hash Chaining", "SubSection": "", - "SubSectionObjective": "Digital signatures allows for external verification of log data tampering and\nhash chaining allows for deleted log files to be detected.", + "SubSectionObjective": "Digital signatures allows for external verification of log data tampering and hash chaining allows for deleted log files to be detected.", "Applicability": [ "tlp-red" ], - "Recommendation": "Ensure hash of data is included in digital signature.\n", + "Recommendation": "Ensure hash of data is included in digital signature. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -49,19 +49,19 @@ ] }, { - "Id": "CCC.AuditLog.C01.TR02", + "Id": "CCC.AuditLog.CN01.AR02", "Description": "When the signature validation process is performed, then it MUST detect any missing (deleted) log file.", "Attributes": [ { "FamilyName": "Integrity", "FamilyDescription": "Controls designed to protected the integrity of Audit Log data.", - "Section": "CCC.AuditLog.C01 Implement Digital Signatures With Hash Chaining", + "Section": "CCC.AuditLog.CN01 Implement Digital Signatures With Hash Chaining", "SubSection": "", - "SubSectionObjective": "Digital signatures allows for external verification of log data tampering and\nhash chaining allows for deleted log files to be detected.", + "SubSectionObjective": "Digital signatures allows for external verification of log data tampering and hash chaining allows for deleted log files to be detected.", "Applicability": [ "tlp-red" ], - "Recommendation": "Ensure verification process includes a chained hash function.\n", + "Recommendation": "Ensure verification process includes a chained hash function. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -92,15 +92,15 @@ ] }, { - "Id": "CCC.AuditLog.C02.TR01", - "Description": "When a manual action is performed to generate each audit log type,\nthen the corresponding audit log type MUST be generated and recorded.", + "Id": "CCC.AuditLog.CN02.AR01", + "Description": "When a manual action is performed to generate each audit log type, then the corresponding audit log type MUST be generated and recorded.", "Attributes": [ { "FamilyName": "Integrity", "FamilyDescription": "Controls designed to protected the integrity of Audit Log data.", - "Section": "CCC.AuditLog.C02 Enable And Validate All Audit Log Types", + "Section": "CCC.AuditLog.CN02 Enable And Validate All Audit Log Types", "SubSection": "", - "SubSectionObjective": "Review audit log configuration and ensure that all audit log types\nare being generated and replicated to configured sinks", + "SubSectionObjective": "Review audit log configuration and ensure that all audit log types are being generated and replicated to configured sinks", "Applicability": [ "tlp-red", "tlp-amber" @@ -149,20 +149,20 @@ ] }, { - "Id": "CCC.AuditLog.C03.TR01", + "Id": "CCC.AuditLog.CN03.AR01", "Description": "When an attempt is made to disable a log source, then an alert MUST be generated.", "Attributes": [ { "FamilyName": "Integrity", "FamilyDescription": "Controls designed to protected the integrity of Audit Log data.", - "Section": "CCC.AuditLog.C03 Alert On Audit Log Changes And Access", + "Section": "CCC.AuditLog.CN03 Alert On Audit Log Changes And Access", "SubSection": "", - "SubSectionObjective": "Ensure that specific alerts have been configured to detect changes in\naudit log configuration such as disabling exporting of logs.\nAlerts MUST also be created to detect changes in retention/object lock policies\nfor exported data log sources/buckets.", + "SubSectionObjective": "Ensure that specific alerts have been configured to detect changes in audit log configuration such as disabling exporting of logs. Alerts MUST also be created to detect changes in retention/object lock policies for exported data log sources/buckets.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Ensure alerting is correctly configured\n", + "Recommendation": "Ensure alerting is correctly configured ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -200,20 +200,20 @@ ] }, { - "Id": "CCC.AuditLog.C03.TR02", - "Description": "When an attempt is made to alter the retention or object lock status\nof an external data log source or bucket, then an alert MUST be generated.", + "Id": "CCC.AuditLog.CN03.AR02", + "Description": "When an attempt is made to alter the retention or object lock status of an external data log source or bucket, then an alert MUST be generated.", "Attributes": [ { "FamilyName": "Integrity", "FamilyDescription": "Controls designed to protected the integrity of Audit Log data.", - "Section": "CCC.AuditLog.C03 Alert On Audit Log Changes And Access", + "Section": "CCC.AuditLog.CN03 Alert On Audit Log Changes And Access", "SubSection": "", - "SubSectionObjective": "Ensure that specific alerts have been configured to detect changes in\naudit log configuration such as disabling exporting of logs.\nAlerts MUST also be created to detect changes in retention/object lock policies\nfor exported data log sources/buckets.", + "SubSectionObjective": "Ensure that specific alerts have been configured to detect changes in audit log configuration such as disabling exporting of logs. Alerts MUST also be created to detect changes in retention/object lock policies for exported data log sources/buckets.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Ensure alerting is correctly configured\n", + "Recommendation": "Ensure alerting is correctly configured ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -254,20 +254,20 @@ ] }, { - "Id": "CCC.AuditLog.C04.TR01", - "Description": "When audit log buckets are created then verify that server access\nlogging MUST be enabled for the audit log bucket,\nwith logs delivered to a separate, secure logging bucket.", + "Id": "CCC.AuditLog.CN04.AR01", + "Description": "When audit log buckets are created then verify that server access logging MUST be enabled for the audit log bucket, with logs delivered to a separate, secure logging bucket.", "Attributes": [ { "FamilyName": "Integrity", "FamilyDescription": "Controls designed to protected the integrity of Audit Log data.", - "Section": "CCC.AuditLog.C04 Ensure Access Logging Is Enabled on the Audit Log Bucket", + "Section": "CCC.AuditLog.CN04 Ensure Access Logging Is Enabled on the Audit Log Bucket", "SubSection": "", - "SubSectionObjective": "Ensure that access logging is enabled for the audit log storage bucket to\ncapture all requests made to the bucket, providing an audit trail of data access.", + "SubSectionObjective": "Ensure that access logging is enabled for the audit log storage bucket to capture all requests made to the bucket, providing an audit trail of data access.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Configure the audit log bucket to enable server access logging.\nEnsure the target logging bucket is configured for appropriate security,\nincluding restricted access and immutability.\n", + "Recommendation": "Configure the audit log bucket to enable server access logging. Ensure the target logging bucket is configured for appropriate security, including restricted access and immutability. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -303,20 +303,20 @@ ] }, { - "Id": "CCC.AuditLog.C05.TR01", + "Id": "CCC.AuditLog.CN05.AR01", "Description": "When audit logs are exported, then audit logs MUST be present in the configured data location.", "Attributes": [ { "FamilyName": "Availability", "FamilyDescription": "Controls designed to protected the availability of Audit Log data.", - "Section": "CCC.AuditLog.C05 Export Audit Logs To Bucket", + "Section": "CCC.AuditLog.CN05 Export Audit Logs To Bucket", "SubSection": "", - "SubSectionObjective": "Configure audit logs to be sent to a external bucket where they can be globally replicated\nand can be subject to greater access control and data retention polices.", + "SubSectionObjective": "Configure audit logs to be sent to a external bucket where they can be globally replicated and can be subject to greater access control and data retention polices.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Configure audit log exporting.\n", + "Recommendation": "Configure audit log exporting. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -357,21 +357,21 @@ ] }, { - "Id": "CCC.AuditLog.C06.TR01", - "Description": "When the retention policy is applied, then data MUST\nbe automatically deleted after the configured number of days.", + "Id": "CCC.AuditLog.CN06.AR01", + "Description": "When the retention policy is applied, then data MUST be automatically deleted after the configured number of days.", "Attributes": [ { "FamilyName": "Availability", "FamilyDescription": "Controls designed to protected the availability of Audit Log data.", - "Section": "CCC.AuditLog.C06 Enforce Retention Policy on Audit Log Bucket", + "Section": "CCC.AuditLog.CN06 Enforce Retention Policy on Audit Log Bucket", "SubSection": "", - "SubSectionObjective": "Configure a custom retention policy on the designated audit log bucket to ensure that logs are\nretained for the correct number of days as defined by your organization's policy.", + "SubSectionObjective": "Configure a custom retention policy on the designated audit log bucket to ensure that logs are retained for the correct number of days as defined by your organization's policy.", "Applicability": [ "tlp-red", "tlp-amber", "tlp-green" ], - "Recommendation": "Configure the audit log bucket's lifecycle rules or object retention settings to enforce\nthe required data retention period.\n", + "Recommendation": "Configure the audit log bucket's lifecycle rules or object retention settings to enforce the required data retention period. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -403,21 +403,21 @@ ] }, { - "Id": "CCC.AuditLog.C07.TR01", - "Description": "When a standard file deletion is attempted on an object within\nthe audit log bucket, then it MUST be prevented unless MFA is provided.", + "Id": "CCC.AuditLog.CN07.AR01", + "Description": "When a standard file deletion is attempted on an object within the audit log bucket, then it MUST be prevented unless MFA is provided.", "Attributes": [ { "FamilyName": "Availability", "FamilyDescription": "Controls designed to protected the availability of Audit Log data.", - "Section": "CCC.AuditLog.C07 Enforce MFA Delete on Audit Log Bucket", + "Section": "CCC.AuditLog.CN07 Enforce MFA Delete on Audit Log Bucket", "SubSection": "", - "SubSectionObjective": "Enable Multi-Factor Authentication (MFA) delete on the audit log bucket to\nprovide greater protection against accidental or malicious deletion of audit data.", + "SubSectionObjective": "Enable Multi-Factor Authentication (MFA) delete on the audit log bucket to provide greater protection against accidental or malicious deletion of audit data.", "Applicability": [ "tlp-red", "tlp-amber", "tlp-green" ], - "Recommendation": "Enable MFA Delete (or equivalent multi-factor authentication for delete operations)\non the audit log bucket.\n", + "Recommendation": "Enable MFA Delete (or equivalent multi-factor authentication for delete operations) on the audit log bucket. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -449,20 +449,20 @@ ] }, { - "Id": "CCC.AuditLog.C08.TR01", - "Description": "When an attempt is made to delete data before the object\nlock period expires, then the deletion MUST be denied.", + "Id": "CCC.AuditLog.CN08.AR01", + "Description": "When an attempt is made to delete data before the object lock period expires, then the deletion MUST be denied.", "Attributes": [ { "FamilyName": "Availability", "FamilyDescription": "Controls designed to protected the availability of Audit Log data.", - "Section": "CCC.AuditLog.C08 Enable Object Lock On Audit Log Bucket", + "Section": "CCC.AuditLog.CN08 Enable Object Lock On Audit Log Bucket", "SubSection": "", - "SubSectionObjective": "Ensure that object log is enabled globally on all objects with the bucket.\nThe lock time MUST be configured to meet your organization, legal and compliance goals.\nDeletion attempts before the lock period MUST be denied.", + "SubSectionObjective": "Ensure that object log is enabled globally on all objects with the bucket. The lock time MUST be configured to meet your organization, legal and compliance goals. Deletion attempts before the lock period MUST be denied.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Configure object lock policy.\n", + "Recommendation": "Configure object lock policy. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -493,20 +493,20 @@ ] }, { - "Id": "CCC.AuditLog.C09.TR01", + "Id": "CCC.AuditLog.CN09.AR01", "Description": "When restricted fields are accessed by unauthorized users, then those fields MUST remain masked.", "Attributes": [ { "FamilyName": "Confidentiality", "FamilyDescription": "Controls designed to protected the confidentiality of Audit Log data.", - "Section": "CCC.AuditLog.C09 Restrict Field And Log Type Access", + "Section": "CCC.AuditLog.CN09 Restrict Field And Log Type Access", "SubSection": "", - "SubSectionObjective": "Configure access to audit logs to follow the principle of least privilege in particular where technically\npossible limit the log fields users have access to to prevent accidental exposure to sensitive\ninformation such as PII.", + "SubSectionObjective": "Configure access to audit logs to follow the principle of least privilege in particular where technically possible limit the log fields users have access to to prevent accidental exposure to sensitive information such as PII.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Review field level access controls on audit data.\n", + "Recommendation": "Review field level access controls on audit data. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -545,21 +545,21 @@ ] }, { - "Id": "CCC.AuditLog.C10.TR01", - "Description": "When audit log storage bucket's are created then, bucket's access control settings MUST explicitly deny\npublic read and write access.", + "Id": "CCC.AuditLog.CN10.AR01", + "Description": "When audit log storage bucket's are created then, bucket's access control settings MUST explicitly deny public read and write access.", "Attributes": [ { "FamilyName": "Confidentiality", "FamilyDescription": "Controls designed to protected the confidentiality of Audit Log data.", - "Section": "CCC.AuditLog.C10 Ensure Audit Bucket is Not Publicly Accessible", + "Section": "CCC.AuditLog.CN10 Ensure Audit Bucket is Not Publicly Accessible", "SubSection": "", - "SubSectionObjective": "Ensure that audit log storage buckets are not publicly accessible to prevent\nunauthorized exposure of sensitive log data.", + "SubSectionObjective": "Ensure that audit log storage buckets are not publicly accessible to prevent unauthorized exposure of sensitive log data.", "Applicability": [ "tlp-red", "tlp-amber", "tlp-green" ], - "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access.\nRegularly review bucket permissions to ensure no public access has been inadvertently granted.\n", + "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access. Regularly review bucket permissions to ensure no public access has been inadvertently granted. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -593,21 +593,21 @@ ] }, { - "Id": "CCC.AuditLog.C10.TR02", - "Description": "When the URL of a audit log storage bucket's object is accessed publicly then,\nit should be denied by bucket policy.", + "Id": "CCC.AuditLog.CN10.AR02", + "Description": "When the URL of a audit log storage bucket's object is accessed publicly then, it should be denied by bucket policy.", "Attributes": [ { "FamilyName": "Confidentiality", "FamilyDescription": "Controls designed to protected the confidentiality of Audit Log data.", - "Section": "CCC.AuditLog.C10 Ensure Audit Bucket is Not Publicly Accessible", + "Section": "CCC.AuditLog.CN10 Ensure Audit Bucket is Not Publicly Accessible", "SubSection": "", - "SubSectionObjective": "Ensure that audit log storage buckets are not publicly accessible to prevent\nunauthorized exposure of sensitive log data.", + "SubSectionObjective": "Ensure that audit log storage buckets are not publicly accessible to prevent unauthorized exposure of sensitive log data.", "Applicability": [ "tlp-red", "tlp-amber", "tlp-green" ], - "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access.\nRegularly review bucket permissions to ensure no public access has been inadvertently granted.\n", + "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access. Regularly review bucket permissions to ensure no public access has been inadvertently granted. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -642,15 +642,15 @@ ] }, { - "Id": "CCC.Build.C01.TR01", + "Id": "CCC.Build.CN01.AR01", "Description": "Attempt to initiate a build using an unauthorized build agent and verify that the build is rejected.", "Attributes": [ { "FamilyName": "Access Control", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.Build.C01 Restrict Allowed Build Agents", + "Section": "CCC.Build.CN01 Restrict Allowed Build Agents", "SubSection": "", - "SubSectionObjective": "Ensure that builds are executed only on authorized build agents to maintain\ncontrol over the build environment and prevent unauthorized code execution.", + "SubSectionObjective": "Ensure that builds are executed only on authorized build agents to maintain control over the build environment and prevent unauthorized code execution.", "Applicability": [ "tlp-red", "tlp-amber" @@ -693,15 +693,15 @@ ] }, { - "Id": "CCC.Build.C02.TR01", - "Description": "Attempt to trigger a build from an unauthorized external service or\nrepository and verify that the build does not start.", + "Id": "CCC.Build.CN02.AR01", + "Description": "Attempt to trigger a build from an unauthorized external service or repository and verify that the build does not start.", "Attributes": [ { "FamilyName": "Access Control", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.Build.C02 Restrict Allowed External Services for Build Triggers", + "Section": "CCC.Build.CN02 Restrict Allowed External Services for Build Triggers", "SubSection": "", - "SubSectionObjective": "Ensure that builds can only be triggered by authorized external services or\nrepositories to prevent unauthorized code execution or tampering.", + "SubSectionObjective": "Ensure that builds can only be triggered by authorized external services or repositories to prevent unauthorized code execution or tampering.", "Applicability": [ "tlp-red", "tlp-amber" @@ -740,15 +740,15 @@ ] }, { - "Id": "CCC.Build.C03.TR01", + "Id": "CCC.Build.CN03.AR01", "Description": "Attempt to access the build environment from an external network and verify that access is denied.", "Attributes": [ { "FamilyName": "Network Security", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.Build.C03 Deny External Network Access for Build Environments", + "Section": "CCC.Build.CN03 Deny External Network Access for Build Environments", "SubSection": "", - "SubSectionObjective": "Ensure that build environments do not have external network access to\nprevent unauthorized external access and data exfiltration.", + "SubSectionObjective": "Ensure that build environments do not have external network access to prevent unauthorized external access and data exfiltration.", "Applicability": [ "tlp-red", "tlp-amber" @@ -785,15 +785,15 @@ ] }, { - "Id": "CCC.CntrReg.C01.TR01", - "Description": "Attempt to push an artifact with known vulnerabilities to the registry\nand observe if it is flagged or rejected by the vulnerability scanning process.", + "Id": "CCC.CntrReg.CN01.AR01", + "Description": "Attempt to push an artifact with known vulnerabilities to the registry and observe if it is flagged or rejected by the vulnerability scanning process.", "Attributes": [ { "FamilyName": "Risk Management", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.CntrReg.C01 Implement Vulnerability Scanning for Artifacts", + "Section": "CCC.CntrReg.CN01 Implement Vulnerability Scanning for Artifacts", "SubSection": "", - "SubSectionObjective": "Ensure that container images and artifacts stored in the container registry are scanned for\nvulnerabilities to identify and remediate security issues before deployment.", + "SubSectionObjective": "Ensure that container images and artifacts stored in the container registry are scanned for vulnerabilities to identify and remediate security issues before deployment.", "Applicability": [ "tlp-red", "tlp-amber" @@ -830,59 +830,15 @@ ] }, { - "Id": "CCC.CntrReg.C02.TR01", - "Description": "Confirm that artifacts older than the specified retention period are automatically\ndeleted from the registry.", - "Attributes": [ - { - "FamilyName": "Data Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.CntrReg.C02 Implement Cleanup Policies for Artifacts", - "SubSection": "", - "SubSectionObjective": "Ensure that unused or outdated artifacts are cleaned up according to defined policies to\nmanage storage effectively and reduce security risks associated with outdated versions.", - "Applicability": [ - "tlp-red", - "tlp-amber" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.TH14" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.IP-6" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SI-12" - ] - } - ] - } - ], - "Checks": [ - "ecr_repositories_lifecycle_policy_enabled", - "s3_bucket_lifecycle_enabled" - ] - }, - { - "Id": "CCC.DataWar.C01.TR01", - "Description": "Attempt to access underlying database tables directly without\nusing managed views and verify that access is denied.", + "Id": "CCC.DataWar.CN01.AR01", + "Description": "Attempt to access underlying database tables directly without using managed views and verify that access is denied.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.DataWar.C01 Enforce Use of Managed Views for Data Access", + "Section": "CCC.DataWar.CN01 Enforce Use of Managed Views for Data Access", "SubSection": "", - "SubSectionObjective": "Ensure that data access is provided through managed views, restricting users\nfrom accessing underlying tables directly and enforcing consistent security policies.", + "SubSectionObjective": "Ensure that data access is provided through managed views, restricting users from accessing underlying tables directly and enforcing consistent security policies.", "Applicability": [ "tlp-red", "tlp-amber" @@ -916,15 +872,15 @@ "Checks": [] }, { - "Id": "CCC.DataWar.C02.TR01", - "Description": "Attempt to query sensitive columns without the necessary permissions and\nverify that access is denied or data is masked.", + "Id": "CCC.DataWar.CN02.AR01", + "Description": "Attempt to query sensitive columns without the necessary permissions and verify that access is denied or data is masked.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.DataWar.C02 Enforce Column-Level Security Policies", + "Section": "CCC.DataWar.CN02 Enforce Column-Level Security Policies", "SubSection": "", - "SubSectionObjective": "Ensure that access to sensitive data columns is restricted based on user roles,\npreventing unauthorized access to sensitive information.", + "SubSectionObjective": "Ensure that access to sensitive data columns is restricted based on user roles, preventing unauthorized access to sensitive information.", "Applicability": [ "tlp-red", "tlp-amber" @@ -958,15 +914,15 @@ "Checks": [] }, { - "Id": "CCC.DataWar.C03.TR01", - "Description": "Attempt to query data rows that the user should not have access to and verify\nthat access is denied or data is not returned.", + "Id": "CCC.DataWar.CN03.AR01", + "Description": "Attempt to query data rows that the user should not have access to and verify that access is denied or data is not returned.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.DataWar.C03 Enforce Row-Level Security Policies", + "Section": "CCC.DataWar.CN03 Enforce Row-Level Security Policies", "SubSection": "", - "SubSectionObjective": "Ensure that access to data rows is restricted based on user roles or attributes,\npreventing unauthorized access to specific subsets of data.", + "SubSectionObjective": "Ensure that access to data rows is restricted based on user roles or attributes, preventing unauthorized access to specific subsets of data.", "Applicability": [ "tlp-red", "tlp-amber" @@ -1000,743 +956,13 @@ "Checks": [] }, { - "Id": "CCC.GenAI.C01.TR01", - "Description": "Untrusted input such as user queries, RAG data or tool output\nMUST be validated before it is passed to a GenAI model.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C01 Model Input Filtering and Sanitisation", - "SubSection": "", - "SubSectionObjective": "Inspect and validate input before it is passed to a GenAI\nmodel in order to filter or sanitise adversarial queries\nand prevent sensitive data leakage.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH01", - "CCC.GenAI.TH03" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-003", - "AIR-PREV-017", - "AIR-PREV-002", - "AIR-DET-001" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Input Validation and Sanitization" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0020", - "AML.M0021", - "AML.M0015" - ] - } - ] - } - ], - "Checks": [ - "bedrock_guardrail_prompt_attack_filter_enabled", - "bedrock_guardrail_sensitive_information_filter_enabled", - "bedrock_model_invocation_logging_enabled", - "bedrock_model_invocation_logs_encryption_enabled", - "bedrock_agent_guardrail_enabled" - ] - }, - { - "Id": "CCC.GenAI.C01.TR02", - "Description": "If malicious patterns such as prompt injection or sensitive\ndata are detected during input validation, the input MUST\nbe blocked or sanitised.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C01 Model Input Filtering and Sanitisation", - "SubSection": "", - "SubSectionObjective": "Inspect and validate input before it is passed to a GenAI\nmodel in order to filter or sanitise adversarial queries\nand prevent sensitive data leakage.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH01", - "CCC.GenAI.TH03" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-003", - "AIR-PREV-017", - "AIR-PREV-002", - "AIR-DET-001" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Input Validation and Sanitization" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0020", - "AML.M0021", - "AML.M0015" - ] - } - ] - } - ], - "Checks": [ - "bedrock_guardrail_prompt_attack_filter_enabled", - "bedrock_guardrail_sensitive_information_filter_enabled" - ] - }, - { - "Id": "CCC.GenAI.C02.TR01", - "Description": "GenAI model output MUST be validated for format conformance,\nmalicious patterns, sensitive data and inapropriate content\nbefore being passed to users, application or plugins.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C02 Model Output Filtering and Sanitisation", - "SubSection": "", - "SubSectionObjective": "Inspect and validate GenAI model output before passing it to\nusers, applications or plugins in order to filter or sanitise\ninsecure or unreliable output and prevent sensitive data leakage.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH01", - "CCC.GenAI.TH03", - "CCC.GenAI.TH04", - "CCC.GenAI.TH05", - "CCC.GenAI.TH06" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-003", - "AIR-PREV-017", - "AIR-PREV-002", - "AIR-DET-001" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Output Validation and Sanitization" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0020", - "AML.M0002" - ] - } - ] - } - ], - "Checks": [ - "bedrock_guardrail_sensitive_information_filter_enabled", - "bedrock_guardrail_prompt_attack_filter_enabled" - ] - }, - { - "Id": "CCC.GenAI.C02.TR02", - "Description": "In the event of policy violations, the AI-generated content MUST\nbe redacted, encoded or rejected.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C02 Model Output Filtering and Sanitisation", - "SubSection": "", - "SubSectionObjective": "Inspect and validate GenAI model output before passing it to\nusers, applications or plugins in order to filter or sanitise\ninsecure or unreliable output and prevent sensitive data leakage.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH01", - "CCC.GenAI.TH03", - "CCC.GenAI.TH04", - "CCC.GenAI.TH05", - "CCC.GenAI.TH06" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-003", - "AIR-PREV-017", - "AIR-PREV-002", - "AIR-DET-001" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Output Validation and Sanitization" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0020", - "AML.M0002" - ] - } - ] - } - ], - "Checks": [ - "bedrock_guardrail_prompt_attack_filter_enabled", - "bedrock_guardrail_sensitive_information_filter_enabled", - "bedrock_model_invocation_logging_enabled", - "bedrock_model_invocation_logs_encryption_enabled", - "bedrock_agent_guardrail_enabled" - ] - }, - { - "Id": "CCC.GenAI.C03.TR01", - "Description": "When data is designated for model training or RAG ingestion, then its\nsource MUST be explicitly approved and its provenance documented.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C03 Data Provenance and Source Vetting", - "SubSection": "", - "SubSectionObjective": "Ensure that all data for training, fine-tuning or RAG comes\nfrom trusted, approved sources and is authorised for the\nintended purposes in order to prevent the initial introduction\nof malicious content or leaked sensitive data.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH02", - "CCC.GenAI.TH03" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-006" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Training Data Management" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0025" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.GenAI.C03.TR02", - "Description": "Data from unvetted sources MUST NOT be used in production systems.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C03 Data Provenance and Source Vetting", - "SubSection": "", - "SubSectionObjective": "Ensure that all data for training, fine-tuning or RAG comes\nfrom trusted, approved sources and is authorised for the\nintended purposes in order to prevent the initial introduction\nof malicious content or leaked sensitive data.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH02", - "CCC.GenAI.TH03" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-006" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Training Data Management" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0025" - ] - } - ] - } - ], - "Checks": [ - "vpc_endpoint_services_allowed_principals_trust_boundaries", - "vpc_endpoint_connections_trust_boundaries", - "s3_bucket_cross_account_access", - "s3_bucket_cross_region_replication", - "s3_bucket_public_access", - "s3_bucket_public_list_acl", - "s3_bucket_public_write_acl", - "s3_bucket_secure_transport_policy", - "s3_bucket_kms_encryption", - "s3_account_level_public_access_blocks", - "s3_bucket_level_public_access_block", - "s3_access_point_public_access_block" - ] - }, - { - "Id": "CCC.GenAI.C04.TR01", - "Description": "When data is ingested for training, fine-tuning or conversion\nto vector embeddings, it MUST be validated for sensitive\ninformation or malicious content.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C04 Sanitisation of Ingested Data", - "SubSection": "", - "SubSectionObjective": "Validate and sanitise all data ingested by GenAI systems\nfrom extenal sources or internal knowledge bases, whether\nfor training, conversion to vector embeddings, or real-time\nretireval, in order to remove or redact poisoned or sensitive\ndata before further processing.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH02", - "CCC.GenAI.TH03" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-002" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Training Data Sanitization" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0007" - ] - } - ] - } - ], - "Checks": [ - "cloudformation_stack_outputs_find_secrets", - "ec2_instance_secrets_user_data", - "ec2_launch_template_no_secrets", - "ssm_document_secrets", - "cloudwatch_log_group_no_secrets_in_logs", - "awslambda_function_no_secrets_in_variables", - "awslambda_function_no_secrets_in_code" - ] - }, - { - "Id": "CCC.GenAI.C04.TR02", - "Description": "If sensitive data or malicious content is detected, it must\nbe rejected, redacted or flagged for manual review.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C04 Sanitisation of Ingested Data", - "SubSection": "", - "SubSectionObjective": "Validate and sanitise all data ingested by GenAI systems\nfrom extenal sources or internal knowledge bases, whether\nfor training, conversion to vector embeddings, or real-time\nretireval, in order to remove or redact poisoned or sensitive\ndata before further processing.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH02", - "CCC.GenAI.TH03" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-002" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Training Data Sanitization" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0007" - ] - } - ] - } - ], - "Checks": [ - "bedrock_guardrail_prompt_attack_filter_enabled", - "bedrock_guardrail_sensitive_information_filter_enabled", - "bedrock_agent_guardrail_enabled" - ] - }, - { - "Id": "CCC.GenAI.C05.TR01", - "Description": "When a RAG-enabled system generates a response containing information\nretrieved from its knowledge base, then the response MUST include a\nverifiable citation that links back to the specific source document.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C05 Citations and Source Traceability", - "SubSection": "", - "SubSectionObjective": "Require the GenAI system to provide citations or direct links\nback to the source documents used to generate a response, in\nto enhance the transparency, trustworthiness, and verifiability\nof AI-generated content.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH09", - "CCC.GenAI.TH04" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-DET-013" - ] - } - ] - } - ], - "Checks": [ - "cloudtrail_multi_region_enabled", - "cloudtrail_cloudwatch_logging_enabled", - "cloudtrail_kms_encryption_enabled", - "cloudtrail_logs_s3_bucket_is_not_publicly_accessible", - "cloudtrail_s3_dataevents_read_enabled", - "cloudtrail_s3_dataevents_write_enabled", - "cloudtrail_log_file_validation_enabled" - ] - }, - { - "Id": "CCC.GenAI.C06.TR01", - "Description": "When an LLM invokes an external tool (e.g., an API, a plugin),\nthen the tool MUST operate with the least privileges required\nfor performing its intended functionality.", - "Attributes": [ - { - "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", - "Section": "CCC.GenAI.C06 Least Privilege for Plugins", - "SubSection": "", - "SubSectionObjective": "Restricts the permissions of any external tools the GenAI system\ncan call to limit the potential damage if an agent is coerced\nto perform unintended actions or vulnerabilities in the tools\nare exploited.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH07", - "CCC.GenAI.TH06" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Agent Permissions" - ] - } - ] - } - ], - "Checks": [ - "apigateway_restapi_authorizers_enabled", - "apigatewayv2_api_authorizers_enabled", - "apigateway_restapi_public", - "apigateway_restapi_public_with_authorizer", - "awslambda_function_url_public", - "awslambda_function_not_publicly_accessible", - "iam_policy_allows_privilege_escalation", - "iam_inline_policy_allows_privilege_escalation", - "iam_policy_no_full_access_to_cloudtrail", - "iam_policy_no_full_access_to_kms", - "iam_inline_policy_no_full_access_to_cloudtrail", - "iam_inline_policy_no_full_access_to_kms", - "iam_group_administrator_access_policy", - "iam_user_administrator_access_policy", - "iam_role_administratoraccess_policy" - ] - }, - { - "Id": "CCC.GenAI.C07.TR01", - "Description": "When an application makes an API call to a foundational model in a\nproduction environment, then it MUST specify an explicit version\nidentifier.", - "Attributes": [ - { - "FamilyName": "Configuration Management", - "FamilyDescription": "The Configuration Management control family involves establishing,\nmaintaining and monitoring the configuration of the service and\nrelated applications and infrastructure to ensure consistency,\nsecure defaults and compliance.\n", - "Section": "CCC.GenAI.C07 Model Version Pinning", - "SubSection": "", - "SubSectionObjective": "Mandate that applications are locked (\"pinned\") to a specific,\ntested version of a foundational model to prevent unexpected\nbehaviour changes introduced by provider-side updates.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH10" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-010" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.GenAI.C08.TR01", - "Description": "When a new AI model is considered for production deployment, it\nMUST undergo a formal red teaming and quality assurance review.", - "Attributes": [ - { - "FamilyName": "Model Assurance and Evaluation", - "FamilyDescription": "The Model Assurance and Evaluation control family encompasses\nthe proactiveand continuous processes of testing and validating\nthe AI model's behavior to ensure it aligns with safety, ethical,\nand quality standards.\n", - "Section": "CCC.GenAI.C08 Quality Control and Red Teaming", - "SubSection": "", - "SubSectionObjective": "Establish a formal program for quality evaluation and adversarial\ntesting (red teaming) to ensure GenAI system meet all business,\nquality, security and compliance requirements before getting deployed\ninto production environments.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH01", - "CCC.GenAI.TH02", - "CCC.GenAI.TH04", - "CCC.GenAI.TH08", - "CCC.GenAI.TH10" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-005" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Adversarial Training and Testing", - "Red Teaming", - "Product Governance" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0008" - ] - } - ] - } - ], - "Checks": [ - "bedrock_guardrail_prompt_attack_filter_enabled", - "bedrock_guardrail_sensitive_information_filter_enabled", - "bedrock_agent_guardrail_enabled", - "bedrock_model_invocation_logging_enabled", - "bedrock_model_invocation_logs_encryption_enabled", - "bedrock_api_key_no_administrative_privileges", - "bedrock_api_key_no_long_term_credentials" - ] - }, - { - "Id": "CCC.GenAI.C08.TR02", - "Description": "If model quality review or red teaming identifies an issue that exceeds\nthe organization's risk tolerance, the model MUST NOT be deployed until\nthe issue is remediated.", - "Attributes": [ - { - "FamilyName": "Model Assurance and Evaluation", - "FamilyDescription": "The Model Assurance and Evaluation control family encompasses\nthe proactiveand continuous processes of testing and validating\nthe AI model's behavior to ensure it aligns with safety, ethical,\nand quality standards.\n", - "Section": "CCC.GenAI.C08 Quality Control and Red Teaming", - "SubSection": "", - "SubSectionObjective": "Establish a formal program for quality evaluation and adversarial\ntesting (red teaming) to ensure GenAI system meet all business,\nquality, security and compliance requirements before getting deployed\ninto production environments.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH01", - "CCC.GenAI.TH02", - "CCC.GenAI.TH04", - "CCC.GenAI.TH08", - "CCC.GenAI.TH10" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-005" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Adversarial Training and Testing", - "Red Teaming", - "Product Governance" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0008" - ] - } - ] - } - ], - "Checks": [ - "bedrock_guardrail_prompt_attack_filter_enabled", - "bedrock_guardrail_sensitive_information_filter_enabled", - "bedrock_model_invocation_logging_enabled", - "bedrock_model_invocation_logs_encryption_enabled", - "bedrock_agent_guardrail_enabled", - "bedrock_api_key_no_administrative_privileges", - "bedrock_api_key_no_long_term_credentials" - ] - }, - { - "Id": "CCC.KeyMgmt.C01.TR01", - "Description": "When a key version is scheduled for deletion or disabled, an\nalert MUST be generated within five minutes.", + "Id": "CCC.KeyMgmt.CN01.AR01", + "Description": "When a key version is scheduled for deletion or disabled, an alert MUST be generated within five minutes.", "Attributes": [ { "FamilyName": "Logging and Metrics Publication", "FamilyDescription": "Controls that collect, alert, and retain key-management events.", - "Section": "CCC.KeyMgmt.C01 Alert on Key-version Changes", + "Section": "CCC.KeyMgmt.CN01 Alert on Key-version Changes", "SubSection": "", "SubSectionObjective": "Generate near-real-time alerts when a KMS key version is disabled or scheduled for deletion, enabling rapid investigation and recovery.", "Applicability": [ @@ -1773,13 +999,13 @@ ] }, { - "Id": "CCC.KeyMgmt.C02.TR01", - "Description": "When IAM roles and key policies are reviewed, Decrypt permission\nMUST be granted exclusively to documented authorised principals.", + "Id": "CCC.KeyMgmt.CN02.AR01", + "Description": "When IAM roles and key policies are reviewed, Decrypt permission MUST be granted exclusively to documented authorised principals.", "Attributes": [ { "FamilyName": "Identity and Access Management", "FamilyDescription": "Controls that enforce least-privilege use of KMS operations.", - "Section": "CCC.KeyMgmt.C02 Limit Decrypt Permissions", + "Section": "CCC.KeyMgmt.CN02 Limit Decrypt Permissions", "SubSection": "", "SubSectionObjective": "Restrict the Decrypt operation to authorised principals only, applying the principle of least privilege to protect sensitive data.", "Applicability": [ @@ -1819,13 +1045,13 @@ ] }, { - "Id": "CCC.KeyMgmt.C03.TR01", - "Description": "When rotation settings are examined, rotation MUST be enabled with\nan interval not exceeding 365 days.", + "Id": "CCC.KeyMgmt.CN03.AR01", + "Description": "When rotation settings are examined, rotation MUST be enabled with an interval not exceeding 365 days.", "Attributes": [ { "FamilyName": "Key Lifecycle Management", "FamilyDescription": "Controls that govern creation, rotation, import, and retirement of cryptographic keys.", - "Section": "CCC.KeyMgmt.C03 Enforce Automatic Rotation", + "Section": "CCC.KeyMgmt.CN03 Enforce Automatic Rotation", "SubSection": "", "SubSectionObjective": "Ensure symmetric keys rotate automatically within policy intervals to reduce exposure of key material.", "Applicability": [ @@ -1861,13 +1087,13 @@ ] }, { - "Id": "CCC.KeyMgmt.C04.TR01", - "Description": "When a key import request is processed, the key MUST use an\napproved algorithm (RSA-2048+, EC-P256+) and originate from a\ncertified HSM.", + "Id": "CCC.KeyMgmt.CN04.AR01", + "Description": "When a key import request is processed, the key MUST use an approved algorithm (RSA-2048+, EC-P256+) and originate from a certified HSM.", "Attributes": [ { "FamilyName": "Key Lifecycle Management", "FamilyDescription": "Controls that govern creation, rotation, import, and retirement of cryptographic keys.", - "Section": "CCC.KeyMgmt.C04 Validate Imported Keys", + "Section": "CCC.KeyMgmt.CN04 Validate Imported Keys", "SubSection": "", "SubSectionObjective": "Accept only externally generated keys that meet approved cryptographic strength and provenance requirements.", "Applicability": [ @@ -1906,13 +1132,13 @@ ] }, { - "Id": "CCC.LB.C01.TR01", - "Description": "When a single client sends more than 2000 requests within any\n5-minute sliding window, the load balancer MUST throttle all\nsubsequent requests from that client for at least 60 seconds.", + "Id": "CCC.LB.CN01.AR01", + "Description": "When a single client sends more than 2000 requests within any 5-minute sliding window, the load balancer MUST throttle all subsequent requests from that client for at least 60 seconds.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "Controls that detect anomalous traffic and record load-balancer activity.\n", - "Section": "CCC.LB.C01 Enforce and Detect Rate Limiting", + "FamilyDescription": "Controls that detect anomalous traffic and record load-balancer activity. ", + "Section": "CCC.LB.CN01 Enforce and Detect Rate Limiting", "SubSection": "", "SubSectionObjective": "Detect and throttle malicious or excessive requests to prevent downstream resource exhaustion and brute-force activity.", "Applicability": [ @@ -1920,7 +1146,7 @@ "tlp-amber", "tlp-red" ], - "Recommendation": "Implement per-IP token-bucket limits with and verify via\nsynthetic traffic tests.\n", + "Recommendation": "Implement per-IP token-bucket limits with and verify via synthetic traffic tests. ", "SectionThreatMappings": [ { "ReferenceId": "LB", @@ -1957,13 +1183,13 @@ ] }, { - "Id": "CCC.LB.C01.TR02", - "Description": "When throttling is invoked, the load balancer MUST\nrecord the event in the access log within 5 minutes\nfor alerting and trend analysis.", + "Id": "CCC.LB.CN01.AR02", + "Description": "When throttling is invoked, the load balancer MUST record the event in the access log within 5 minutes for alerting and trend analysis.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "Controls that detect anomalous traffic and record load-balancer activity.\n", - "Section": "CCC.LB.C01 Enforce and Detect Rate Limiting", + "FamilyDescription": "Controls that detect anomalous traffic and record load-balancer activity. ", + "Section": "CCC.LB.CN01 Enforce and Detect Rate Limiting", "SubSection": "", "SubSectionObjective": "Detect and throttle malicious or excessive requests to prevent downstream resource exhaustion and brute-force activity.", "Applicability": [ @@ -1971,7 +1197,7 @@ "tlp-amber", "tlp-red" ], - "Recommendation": "Enable access logging and configure metric filters\non HTTP 429 counts to trigger alerts.\n", + "Recommendation": "Enable access logging and configure metric filters on HTTP 429 counts to trigger alerts. ", "SectionThreatMappings": [ { "ReferenceId": "LB", @@ -2008,21 +1234,21 @@ ] }, { - "Id": "CCC.LB.C06.TR01", - "Description": "When more than 10 percent of targets change from healthy to\nunhealthy within five minutes, an alert MUST be issued.", + "Id": "CCC.LB.CN06.AR01", + "Description": "When more than 10 percent of targets change from healthy to unhealthy within five minutes, an alert MUST be issued.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "Controls that detect anomalous traffic and record load-balancer activity.\n", - "Section": "CCC.LB.C06 Secure Health-Check Telemetry", + "FamilyDescription": "Controls that detect anomalous traffic and record load-balancer activity. ", + "Section": "CCC.LB.CN06 Secure Health-Check Telemetry", "SubSection": "", - "SubSectionObjective": "Monitor health-check endpoints for tampering and alert on\nabnormal status changes.", + "SubSectionObjective": "Monitor health-check endpoints for tampering and alert on abnormal status changes.", "Applicability": [ "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Instrument metrics for health check results and target\nremoval events. Configure monitoring alarms to alert\non abnormal spikes in unhealthy targets.\n", + "Recommendation": "Instrument metrics for health check results and target removal events. Configure monitoring alarms to alert on abnormal spikes in unhealthy targets. ", "SectionThreatMappings": [ { "ReferenceId": "LB", @@ -2056,21 +1282,21 @@ ] }, { - "Id": "CCC.LB.C04.TR01", - "Description": "When routing weights change, the request MUST originate\nfrom an explicitly defined and trusted identity and MUST\nbe logged.", + "Id": "CCC.LB.CN04.AR01", + "Description": "When routing weights change, the request MUST originate from an explicitly defined and trusted identity and MUST be logged.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "Controls that restrict who can change or query load-balancer resources.\n", - "Section": "CCC.LB.C04 Enforce Distribution Policies", + "FamilyDescription": "Controls that restrict who can change or query load-balancer resources. ", + "Section": "CCC.LB.CN04 Enforce Distribution Policies", "SubSection": "", - "SubSectionObjective": "Ensure traffic-splitting weights and algorithms are modified\nonly by trusted identities.", + "SubSectionObjective": "Ensure traffic-splitting weights and algorithms are modified only by trusted identities.", "Applicability": [ "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Define a list of trusted principals allowed to modify\nrouting configurations. Enforce via conditional access\npolicies, and log changes using audit logging.\n", + "Recommendation": "Define a list of trusted principals allowed to modify routing configurations. Enforce via conditional access policies, and log changes using audit logging. ", "SectionThreatMappings": [ { "ReferenceId": "LB", @@ -2105,15 +1331,15 @@ ] }, { - "Id": "CCC.LB.C05.TR01", - "Description": "When stickiness is enabled, session cookies MUST expire\nwithin 30 minutes of inactivity.", + "Id": "CCC.LB.CN05.AR01", + "Description": "When stickiness is enabled, session cookies MUST expire within 30 minutes of inactivity.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "Controls that restrict who can change or query load-balancer resources.\n", - "Section": "CCC.LB.C05 Validate Session Affinity", + "FamilyDescription": "Controls that restrict who can change or query load-balancer resources. ", + "Section": "CCC.LB.CN05 Validate Session Affinity", "SubSection": "", - "SubSectionObjective": "Configure session persistence to minimise fixation and hijacking\nrisks.", + "SubSectionObjective": "Configure session persistence to minimise fixation and hijacking risks.", "Applicability": [ "tlp-green", "tlp-amber", @@ -2162,15 +1388,15 @@ ] }, { - "Id": "CCC.LB.C09.TR01", - "Description": "When an API call originates outside the approved CIDR\nset, the request MUST be denied.", + "Id": "CCC.LB.CN09.AR01", + "Description": "When an API call originates outside the approved CIDR set, the request MUST be denied.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "Controls that restrict who can change or query load-balancer resources.\n", - "Section": "CCC.LB.C09 Restrict Management API Access", + "FamilyDescription": "Controls that restrict who can change or query load-balancer resources. ", + "Section": "CCC.LB.CN09 Restrict Management API Access", "SubSection": "", - "SubSectionObjective": "Limit load-balancer API calls to authorised identities and\ntrusted networks.", + "SubSectionObjective": "Limit load-balancer API calls to authorised identities and trusted networks.", "Applicability": [ "tlp-green", "tlp-amber", @@ -2208,15 +1434,15 @@ ] }, { - "Id": "CCC.LB.C02.TR01", - "Description": "When concurrent connections reach 80 percent of capacity, the\nautoscaling group MUST add at least one instance within five\nminutes.", + "Id": "CCC.LB.CN02.AR01", + "Description": "When concurrent connections reach 80 percent of capacity, the autoscaling group MUST add at least one instance within five minutes.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls that preserve availability and confidentiality of\ntraffic processed by the load balancer.\n", - "Section": "CCC.LB.C02 Auto-Scale Load Balancer Capacity", + "FamilyDescription": "Controls that preserve availability and confidentiality of traffic processed by the load balancer. ", + "Section": "CCC.LB.CN02 Auto-Scale Load Balancer Capacity", "SubSection": "", - "SubSectionObjective": "Expand load-balancer capacity to maintain availability during traffic\nspikes.", + "SubSectionObjective": "Expand load-balancer capacity to maintain availability during traffic spikes.", "Applicability": [ "tlp-green", "tlp-amber", @@ -2256,15 +1482,15 @@ ] }, { - "Id": "CCC.LB.C07.TR01", - "Description": "When responses pass through the load balancer, the\n\"Server\" header MUST be replaced with \"lb\".", + "Id": "CCC.LB.CN07.AR01", + "Description": "When responses pass through the load balancer, the \"Server\" header MUST be replaced with \"lb\".", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls that preserve availability and confidentiality of\ntraffic processed by the load balancer.\n", - "Section": "CCC.LB.C07 Scrub Sensitive Headers", + "FamilyDescription": "Controls that preserve availability and confidentiality of traffic processed by the load balancer. ", + "Section": "CCC.LB.CN07 Scrub Sensitive Headers", "SubSection": "", - "SubSectionObjective": "Remove headers that disclose internal details or software\nversions from HTTP responses.", + "SubSectionObjective": "Remove headers that disclose internal details or software versions from HTTP responses.", "Applicability": [ "tlp-green", "tlp-amber", @@ -2298,15 +1524,15 @@ "Checks": [] }, { - "Id": "CCC.LB.C08.TR01", - "Description": "When a certificate is within 30 days of expiry, automated renewal\nMUST complete and deploy a new certificate within 24 hours.", + "Id": "CCC.LB.CN08.AR01", + "Description": "When a certificate is within 30 days of expiry, automated renewal MUST complete and deploy a new certificate within 24 hours.", "Attributes": [ { "FamilyName": "Encryption", "FamilyDescription": "Controls that ensure trustworthy TLS certificates and ciphers.", - "Section": "CCC.LB.C08 Automate Certificate Renewal", + "Section": "CCC.LB.CN08 Automate Certificate Renewal", "SubSection": "", - "SubSectionObjective": "Maintain valid TLS certificates by automating renewal and\ndeployment before expiry.", + "SubSectionObjective": "Maintain valid TLS certificates by automating renewal and deployment before expiry.", "Applicability": [ "tlp-green", "tlp-amber", @@ -2344,15 +1570,15 @@ ] }, { - "Id": "CCC.Logging.C01.TR01", - "Description": "When a new cloud account is created, provider-level audit and network flow logging MUST be\nenabled by default and directed to the central sink.", + "Id": "CCC.Logging.CN01.AR01", + "Description": "When a new cloud account is created, provider-level audit and network flow logging MUST be enabled by default and directed to the central sink.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data.\n", - "Section": "CCC.Logging.C01 Centralized and Comprehensive Log Aggregation", + "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data. ", + "Section": "CCC.Logging.CN01 Centralized and Comprehensive Log Aggregation", "SubSection": "", - "SubSectionObjective": "Ensure all operational and security logs from across the cloud environment, including\napplications, operating systems, network traffic, and cloud service activity, are captured\nautomatically and streamed to a central, secure log management service.", + "SubSectionObjective": "Ensure all operational and security logs from across the cloud environment, including applications, operating systems, network traffic, and cloud service activity, are captured automatically and streamed to a central, secure log management service.", "Applicability": [ "tlp-clear", "tlp-green", @@ -2402,15 +1628,15 @@ ] }, { - "Id": "CCC.Logging.C01.TR02", - "Description": "When a new cloud compute resource is deployed, it MUST be configured to forward all relevant\nlogs (e.g., OS, application, service logs) to the central log sink.", + "Id": "CCC.Logging.CN01.AR02", + "Description": "When a new cloud compute resource is deployed, it MUST be configured to forward all relevant logs (e.g., OS, application, service logs) to the central log sink.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data.\n", - "Section": "CCC.Logging.C01 Centralized and Comprehensive Log Aggregation", + "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data. ", + "Section": "CCC.Logging.CN01 Centralized and Comprehensive Log Aggregation", "SubSection": "", - "SubSectionObjective": "Ensure all operational and security logs from across the cloud environment, including\napplications, operating systems, network traffic, and cloud service activity, are captured\nautomatically and streamed to a central, secure log management service.", + "SubSectionObjective": "Ensure all operational and security logs from across the cloud environment, including applications, operating systems, network traffic, and cloud service activity, are captured automatically and streamed to a central, secure log management service.", "Applicability": [ "tlp-clear", "tlp-green", @@ -2459,15 +1685,15 @@ ] }, { - "Id": "CCC.Logging.C02.TR01", - "Description": "When a new log bucket or stream is created, its retention policy MUST be configured\nin accordance with organisation's data retention policy.", + "Id": "CCC.Logging.CN02.AR01", + "Description": "When a new log bucket or stream is created, its retention policy MUST be configured in accordance with organisation's data retention policy.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data.\n", - "Section": "CCC.Logging.C02 Enforce Data Retention Policy for Logs", + "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data. ", + "Section": "CCC.Logging.CN02 Enforce Data Retention Policy for Logs", "SubSection": "", - "SubSectionObjective": "Ensure that the retention period configured for logs aligns with the organization's\ndata retention policy.", + "SubSectionObjective": "Ensure that the retention period configured for logs aligns with the organization's data retention policy.", "Applicability": [ "tlp-clear", "tlp-green", @@ -2504,15 +1730,15 @@ ] }, { - "Id": "CCC.Logging.C02.TR02", - "Description": "When a query is performed to retrieve log events older than the number of days defined\nin the organisation's data retention policy, it MUST return an empty result.", + "Id": "CCC.Logging.CN02.AR02", + "Description": "When a query is performed to retrieve log events older than the number of days defined in the organisation's data retention policy, it MUST return an empty result.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data.\n", - "Section": "CCC.Logging.C02 Enforce Data Retention Policy for Logs", + "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data. ", + "Section": "CCC.Logging.CN02 Enforce Data Retention Policy for Logs", "SubSection": "", - "SubSectionObjective": "Ensure that the retention period configured for logs aligns with the organization's\ndata retention policy.", + "SubSectionObjective": "Ensure that the retention period configured for logs aligns with the organization's data retention policy.", "Applicability": [ "tlp-clear", "tlp-green", @@ -2549,20 +1775,20 @@ ] }, { - "Id": "CCC.AuditLog.C08.TR01", - "Description": "When an attempt is made to modify or delete data before the object\nlock period expires, then the action MUST be denied.", + "Id": "CCC.AuditLog.CN08.AR01", + "Description": "When an attempt is made to modify or delete data before the object lock period expires, then the action MUST be denied.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data.\n", - "Section": "CCC.Logging.C03 Enable Object Lock On Log Bucket", + "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data. ", + "Section": "CCC.Logging.CN03 Enable Object Lock On Log Bucket", "SubSection": "", - "SubSectionObjective": "Ensure log immutability by enabling Write Once, Read Many (WORM) protection\nusing object lock on log storage buckets. This prevents logs from being modified\nor deleted during the defined retention period, supporting compliance and forensic\nintegrity.", + "SubSectionObjective": "Ensure log immutability by enabling Write Once, Read Many (WORM) protection using object lock on log storage buckets. This prevents logs from being modified or deleted during the defined retention period, supporting compliance and forensic integrity.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Configure object lock policy.\n", + "Recommendation": "Configure object lock policy. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -2593,20 +1819,20 @@ ] }, { - "Id": "CCC.AuditLog.C04.TR01", + "Id": "CCC.AuditLog.CN04.AR01", "Description": "When restricted fields are accessed by unauthorized users, then those fields MUST remain masked.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "Controls that restrict who can access and modify logs.\n", - "Section": "CCC.Logging.C04 Restrict Field And Log Type Access", + "FamilyDescription": "Controls that restrict who can access and modify logs. ", + "Section": "CCC.Logging.CN04 Restrict Field And Log Type Access", "SubSection": "", - "SubSectionObjective": "Configure access to logs to follow the principle of least privilege in particular where technically\npossible limit the log fields users have access to to prevent accidental exposure to sensitive\ninformation such as PII.", + "SubSectionObjective": "Configure access to logs to follow the principle of least privilege in particular where technically possible limit the log fields users have access to to prevent accidental exposure to sensitive information such as PII.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Review field level access controls on log data.\n", + "Recommendation": "Review field level access controls on log data. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -2642,21 +1868,21 @@ ] }, { - "Id": "CCC.Logging.C05.TR01", - "Description": "When a log storage bucket is created, the bucket's access control settings MUST\nexplicitly deny public read and write access.", + "Id": "CCC.Logging.CN05.AR01", + "Description": "When a log storage bucket is created, the bucket's access control settings MUST explicitly deny public read and write access.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "Controls that restrict who can access and modify logs.\n", - "Section": "CCC.Logging.C05 Ensure Log Bucket is Not Publicly Accessible", + "FamilyDescription": "Controls that restrict who can access and modify logs. ", + "Section": "CCC.Logging.CN05 Ensure Log Bucket is Not Publicly Accessible", "SubSection": "", - "SubSectionObjective": "Ensure that log storage buckets are not publicly accessible to prevent unauthorized\naccess to sensitive log data. In addition, logs should be replicated to another cloud\nregion to enhance availability, durability, and support disaster recovery requirements.", + "SubSectionObjective": "Ensure that log storage buckets are not publicly accessible to prevent unauthorized access to sensitive log data. In addition, logs should be replicated to another cloud region to enhance availability, durability, and support disaster recovery requirements.", "Applicability": [ "tlp-red", "tlp-amber", "tlp-green" ], - "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access.\nRegularly review bucket permissions to ensure no public access has been inadvertently granted.\n", + "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access. Regularly review bucket permissions to ensure no public access has been inadvertently granted. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -2695,21 +1921,21 @@ ] }, { - "Id": "CCC.Logging.C05.TR02", - "Description": "When the URL of a log storage bucket's object is accessed publicly, the action MUST be denied\nby bucket policy.", + "Id": "CCC.Logging.CN05.AR02", + "Description": "When the URL of a log storage bucket's object is accessed publicly, the action MUST be denied by bucket policy.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "Controls that restrict who can access and modify logs.\n", - "Section": "CCC.Logging.C05 Ensure Log Bucket is Not Publicly Accessible", + "FamilyDescription": "Controls that restrict who can access and modify logs. ", + "Section": "CCC.Logging.CN05 Ensure Log Bucket is Not Publicly Accessible", "SubSection": "", - "SubSectionObjective": "Ensure that log storage buckets are not publicly accessible to prevent unauthorized\naccess to sensitive log data. In addition, logs should be replicated to another cloud\nregion to enhance availability, durability, and support disaster recovery requirements.", + "SubSectionObjective": "Ensure that log storage buckets are not publicly accessible to prevent unauthorized access to sensitive log data. In addition, logs should be replicated to another cloud region to enhance availability, durability, and support disaster recovery requirements.", "Applicability": [ "tlp-red", "tlp-amber", "tlp-green" ], - "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access.\nRegularly review bucket permissions to ensure no public access has been inadvertently granted.\n", + "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access. Regularly review bucket permissions to ensure no public access has been inadvertently granted. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -2745,15 +1971,15 @@ ] }, { - "Id": "CCC.Logging.C06.TR01", - "Description": "When a single principal executes an anomalously high number of log queries,\nan alert MUST be generated.", + "Id": "CCC.Logging.CN06.AR01", + "Description": "When a single principal executes an anomalously high number of log queries, an alert MUST be generated.", "Attributes": [ { "FamilyName": "Logging and Monitoring", - "FamilyDescription": "Controls that collect, alert, and retain logging-related events.\n", - "Section": "CCC.Logging.C06 Detect and Alert on Potential Log Exfiltration", + "FamilyDescription": "Controls that collect, alert, and retain logging-related events. ", + "Section": "CCC.Logging.CN06 Detect and Alert on Potential Log Exfiltration", "SubSection": "", - "SubSectionObjective": "Identify and alert on anomalous data access patterns that may indicate an attempt\nto exfiltrate log data.", + "SubSectionObjective": "Identify and alert on anomalous data access patterns that may indicate an attempt to exfiltrate log data.", "Applicability": [ "tlp-green", "tlp-amber", @@ -2793,15 +2019,15 @@ ] }, { - "Id": "CCC.Logging.C07.TR01", - "Description": "When an audit log event is recorded that corresponds to a modification of the logging service\nconfiguration such as disabling a log trail, deleting a log sink, or altering a log forwarding rule,\nan alert MUST be generated.", + "Id": "CCC.Logging.CN07.AR01", + "Description": "When an audit log event is recorded that corresponds to a modification of the logging service configuration such as disabling a log trail, deleting a log sink, or altering a log forwarding rule, an alert MUST be generated.", "Attributes": [ { "FamilyName": "Logging and Monitoring", - "FamilyDescription": "Controls that collect, alert, and retain logging-related events.\n", - "Section": "CCC.Logging.C07 Detect and Alert on Log Service Tampering", + "FamilyDescription": "Controls that collect, alert, and retain logging-related events. ", + "Section": "CCC.Logging.CN07 Detect and Alert on Log Service Tampering", "SubSection": "", - "SubSectionObjective": "Alert when any component of the critical logging infrastructure is disabled, modified,\nor deleted, indicating a defense evasion attempt.", + "SubSectionObjective": "Alert when any component of the critical logging infrastructure is disabled, modified, or deleted, indicating a defense evasion attempt.", "Applicability": [ "tlp-clear", "tlp-green", @@ -2850,13 +2076,13 @@ ] }, { - "Id": "CCC.ObjStor.C01.TR01", + "Id": "CCC.ObjStor.CN01.AR01", "Description": "When a request is made to read a protected bucket, the service MUST prevent any request using KMS keys not listed as trusted by the organization.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C01 Prevent Unencrypted Requests", + "Section": "CCC.CN01 Prevent Unencrypted Requests", "SubSection": "CCC.ObjStor.C01 Prevent Requests to Buckets or Objects with Untrusted KMS Keys", "SubSectionObjective": "Prevent any requests to object storage buckets or objects using untrusted KMS keys to protect against unauthorized data encryption that can impact data availability and integrity.", "Applicability": [ @@ -2910,13 +2136,13 @@ ] }, { - "Id": "CCC.ObjStor.C01.TR02", + "Id": "CCC.ObjStor.CN01.AR02", "Description": "When a request is made to read a protected object, the service MUST prevent any request using KMS keys not listed as trusted by the organization.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C01 Prevent Unencrypted Requests", + "Section": "CCC.CN01 Prevent Unencrypted Requests", "SubSection": "CCC.ObjStor.C01 Prevent Requests to Buckets or Objects with Untrusted KMS Keys", "SubSectionObjective": "Prevent any requests to object storage buckets or objects using untrusted KMS keys to protect against unauthorized data encryption that can impact data availability and integrity.", "Applicability": [ @@ -2970,13 +2196,13 @@ ] }, { - "Id": "CCC.ObjStor.C01.TR03", + "Id": "CCC.ObjStor.CN01.AR03", "Description": "When a request is made to write to a bucket, the service MUST prevent any request using KMS keys not listed as trusted by the organization.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C01 Prevent Unencrypted Requests", + "Section": "CCC.CN01 Prevent Unencrypted Requests", "SubSection": "CCC.ObjStor.C01 Prevent Requests to Buckets or Objects with Untrusted KMS Keys", "SubSectionObjective": "Prevent any requests to object storage buckets or objects using untrusted KMS keys to protect against unauthorized data encryption that can impact data availability and integrity.", "Applicability": [ @@ -3033,13 +2259,13 @@ ] }, { - "Id": "CCC.ObjStor.C01.TR04", + "Id": "CCC.ObjStor.CN01.AR04", "Description": "When a request is made to write to an object, the service MUST prevent any request using KMS keys not listed as trusted by the organization.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C01 Prevent Unencrypted Requests", + "Section": "CCC.CN01 Prevent Unencrypted Requests", "SubSection": "CCC.ObjStor.C01 Prevent Requests to Buckets or Objects with Untrusted KMS Keys", "SubSectionObjective": "Prevent any requests to object storage buckets or objects using untrusted KMS keys to protect against unauthorized data encryption that can impact data availability and integrity.", "Applicability": [ @@ -3096,13 +2322,13 @@ ] }, { - "Id": "CCC.ObjStor.C03.TR01", + "Id": "CCC.ObjStor.CN03.AR01", "Description": "When an object storage bucket deletion is attempted, the bucket MUST be fully recoverable for a set time-frame after deletion is requested.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C03 Implement Multi-factor Authentication (MFA) for Access", + "Section": "CCC.CN03 Implement Multi-factor Authentication (MFA) for Access", "SubSection": "CCC.ObjStor.C03 Prevent Bucket Deletion Through Irrevocable Bucket Retention Policy", "SubSectionObjective": "Ensure that object storage bucket is not deleted after creation, and that the preventative measure cannot be unset.", "Applicability": [ @@ -3156,13 +2382,13 @@ ] }, { - "Id": "CCC.ObjStor.C03.TR02", + "Id": "CCC.ObjStor.CN03.AR02", "Description": "When an attempt is made to modify the retention policy for an object storage bucket, the service MUST prevent the policy from being modified.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C03 Implement Multi-factor Authentication (MFA) for Access", + "Section": "CCC.CN03 Implement Multi-factor Authentication (MFA) for Access", "SubSection": "CCC.ObjStor.C03 Prevent Bucket Deletion Through Irrevocable Bucket Retention Policy", "SubSectionObjective": "Ensure that object storage bucket is not deleted after creation, and that the preventative measure cannot be unset.", "Applicability": [ @@ -3215,13 +2441,13 @@ ] }, { - "Id": "CCC.ObjStor.C04.TR01", + "Id": "CCC.ObjStor.CN04.AR01", "Description": "When an object is uploaded to the object storage system, the object MUST automatically receive a default retention policy that prevents premature deletion or modification.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C04 Log All Access and Changes", + "Section": "CCC.CN04 Log All Access and Changes", "SubSection": "CCC.ObjStor.C04 Objects have an Effective Retention Policy by Default", "SubSectionObjective": "Ensure that all objects stored in the object storage system have a retention policy applied by default, preventing premature deletion or modification of objects and ensuring compliance with data retention regulations.", "Applicability": [ @@ -3275,13 +2501,13 @@ ] }, { - "Id": "CCC.ObjStor.C04.TR02", + "Id": "CCC.ObjStor.CN04.AR02", "Description": "When an attempt is made to delete or modify an object that is subject to an active retention policy, the service MUST prevent the action from being completed.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C04 Log All Access and Changes", + "Section": "CCC.CN04 Log All Access and Changes", "SubSection": "CCC.ObjStor.C04 Objects have an Effective Retention Policy by Default", "SubSectionObjective": "Ensure that all objects stored in the object storage system have a retention policy applied by default, preventing premature deletion or modification of objects and ensuring compliance with data retention regulations.", "Applicability": [ @@ -3334,13 +2560,13 @@ ] }, { - "Id": "CCC.ObjStor.C05.TR01", + "Id": "CCC.ObjStor.CN05.AR01", "Description": "When an object is uploaded to the object storage bucket, the object MUST be stored with a unique identifier.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C05 Prevent Access from Untrusted Entities", + "Section": "CCC.CN05 Prevent Access from Untrusted Entities", "SubSection": "CCC.ObjStor.C05 Versioning is Enabled for All Objects in the Bucket", "SubSectionObjective": "Ensure that versioning is enabled for all objects stored in the object storage bucket to enable recovery of previous versions of objects in case of loss or corruption.", "Applicability": [ @@ -3393,13 +2619,13 @@ ] }, { - "Id": "CCC.ObjStor.C05.TR02", + "Id": "CCC.ObjStor.CN05.AR02", "Description": "When an object is modified, the service MUST assign a new unique identifier to the modified object to differentiate it from the previous version.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C05 Prevent Access from Untrusted Entities", + "Section": "CCC.CN05 Prevent Access from Untrusted Entities", "SubSection": "CCC.ObjStor.C05 Versioning is Enabled for All Objects in the Bucket", "SubSectionObjective": "Ensure that versioning is enabled for all objects stored in the object storage bucket to enable recovery of previous versions of objects in case of loss or corruption.", "Applicability": [ @@ -3454,13 +2680,13 @@ ] }, { - "Id": "CCC.ObjStor.C05.TR03", + "Id": "CCC.ObjStor.CN05.AR03", "Description": "When an object is modified, the service MUST allow for recovery of previous versions of the object.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C05 Prevent Access from Untrusted Entities", + "Section": "CCC.CN05 Prevent Access from Untrusted Entities", "SubSection": "CCC.ObjStor.C05 Versioning is Enabled for All Objects in the Bucket", "SubSectionObjective": "Ensure that versioning is enabled for all objects stored in the object storage bucket to enable recovery of previous versions of objects in case of loss or corruption.", "Applicability": [ @@ -3514,13 +2740,13 @@ ] }, { - "Id": "CCC.ObjStor.C05.TR04", + "Id": "CCC.ObjStor.CN05.AR04", "Description": "When an object is deleted, the service MUST retain other versions of the object to allow for recovery of previous versions.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C05 Prevent Access from Untrusted Entities", + "Section": "CCC.CN05 Prevent Access from Untrusted Entities", "SubSection": "CCC.ObjStor.C05 Versioning is Enabled for All Objects in the Bucket", "SubSectionObjective": "Ensure that versioning is enabled for all objects stored in the object storage bucket to enable recovery of previous versions of objects in case of loss or corruption.", "Applicability": [ @@ -3574,13 +2800,13 @@ ] }, { - "Id": "CCC.ObjStor.C06.TR01", + "Id": "CCC.ObjStor.CN06.AR01", "Description": "When an object storage bucket is accessed, the service MUST store access logs in a separate data store.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C06 Prevent Deployment in Restricted Regions", + "Section": "CCC.CN06 Prevent Deployment in Restricted Regions", "SubSection": "CCC.ObjStor.C06 Access Logs are Stored in a Separate Data Store", "SubSectionObjective": "Ensure that access logs for object storage buckets are stored in a separate data store to protect against unauthorized access, tampering, or deletion of logs (Logbuckets are exempt from this requirement, but must be tlp-red).", "Applicability": [ @@ -3634,13 +2860,13 @@ ] }, { - "Id": "CCC.ObjStor.C02.TR01", + "Id": "CCC.ObjStor.CN02.AR01", "Description": "When a permission set is allowed for an object in a bucket, the service MUST allow the same permission set to access all objects in the same bucket.", "Attributes": [ { "FamilyName": "Identity and Access Management", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C02 Ensure Data Encryption at Rest for All Stored Data", + "Section": "CCC.CN02 Ensure Data Encryption at Rest for All Stored Data", "SubSection": "CCC.ObjStor.C02 Enforce Uniform Bucket-level Access to Prevent Inconsistent Permissions", "SubSectionObjective": "Ensure that uniform bucket-level access is enforced across all object storage buckets. This prevents the use of ad-hoc or inconsistent object-level permissions, ensuring centralized, consistent, and secure access management in accordance with the principle of least privilege.", "Applicability": [ @@ -3692,13 +2918,13 @@ ] }, { - "Id": "CCC.ObjStor.C02.TR02", + "Id": "CCC.ObjStor.CN02.AR02", "Description": "When a permission set is denied for an object in a bucket, the service MUST deny the same permission set to access all objects in the same bucket.", "Attributes": [ { "FamilyName": "Identity and Access Management", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C02 Ensure Data Encryption at Rest for All Stored Data", + "Section": "CCC.CN02 Ensure Data Encryption at Rest for All Stored Data", "SubSection": "CCC.ObjStor.C02 Enforce Uniform Bucket-level Access to Prevent Inconsistent Permissions", "SubSectionObjective": "Ensure that uniform bucket-level access is enforced across all object storage buckets. This prevents the use of ad-hoc or inconsistent object-level permissions, ensuring centralized, consistent, and secure access management in accordance with the principle of least privilege.", "Applicability": [ @@ -3751,972 +2977,9 @@ "s3_bucket_public_access" ] }, - { - "Id": "CCC.MLDE.CN01.AR01", - "Description": "Verify that only authorized users can access MLDE resources,\nand that access modes are properly defined and enforced.", - "Attributes": [ - { - "FamilyName": "Identity and Access Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN01 Define Access Mode for ML Development Environments", - "SubSection": "", - "SubSectionObjective": "Ensure that access to Machine Learning Development Environment (MLDE)\nresources is strictly defined and controlled.\nOnly authorized users with appropriate permissions can access these environments,\nmitigating the risk of unauthorized access, data leakage, or service disruption.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01", - "CCC.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-3" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.1.1", - "2013 A.9.2.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-2", - "AC-3" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-01", - "IAM-02" - ] - } - ] - } - ], - "Checks": [ - "accessanalyzer_enabled", - "accessanalyzer_enabled_without_findings", - "iam_root_mfa_enabled", - "iam_root_credentials_management_enabled", - "iam_avoid_root_usage", - "iam_user_mfa_enabled_console_access", - "awslambda_function_not_publicly_accessible", - "awslambda_function_url_public", - "iam_group_administrator_access_policy", - "iam_user_administrator_access_policy", - "iam_policy_attached_only_to_group_or_roles", - "iam_inline_policy_no_full_access_to_cloudtrail", - "iam_inline_policy_no_full_access_to_kms", - "iam_policy_allows_privilege_escalation", - "s3_bucket_public_access", - "s3_bucket_public_list_acl", - "s3_bucket_public_write_acl", - "s3_account_level_public_access_blocks", - "s3_bucket_cross_account_access" - ] - }, - { - "Id": "CCC.MLDE.CN03.AR01", - "Description": "Verify that root access is disabled on MLDE instances containing sensitive data.", - "Attributes": [ - { - "FamilyName": "Identity and Access Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN03 Disable Root Access on MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Prevent users from obtaining root access on MLDE instances to reduce the\nrisk of unauthorized system modifications and potential security breaches.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-4" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-6" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-08", - "IAM-12" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.2.3" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.MLDE.CN03.AR02", - "Description": "For MLDE instances without sensitive data, ensure that root access is only\nenabled when necessary and properly authorized.", - "Attributes": [ - { - "FamilyName": "Identity and Access Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN03 Disable Root Access on MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Prevent users from obtaining root access on MLDE instances to reduce the\nrisk of unauthorized system modifications and potential security breaches.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-4" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-6" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-08", - "IAM-12" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.2.3" - ] - } - ] - } - ], - "Checks": [ - "ec2_instance_port_ssh_exposed_to_internet", - "ec2_instance_managed_by_ssm", - "ec2_instance_imdsv2_enabled", - "ec2_launch_template_imdsv2_required", - "ec2_instance_account_imdsv2_enabled", - "ec2_instance_public_ip" - ] - }, - { - "Id": "CCC.MLDE.CN04.AR01", - "Description": "Verify that terminal access is disabled on MLDE instances containing sensitive data.", - "Attributes": [ - { - "FamilyName": "Identity and Access Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN04 Disable Terminal Access on MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Prevent users from accessing the terminal on MLDE instances to limit the risk of\nunauthorized commands and potential system compromise.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-4" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-6" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-08" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.2.3" - ] - } - ] - } - ], - "Checks": [ - "ec2_instance_port_ssh_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_all_ports", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389", - "ec2_instance_public_ip", - "ec2_instance_internet_facing_with_instance_profile" - ] - }, - { - "Id": "CCC.MLDE.CN04.AR02", - "Description": "For MLDE instances without sensitive data, ensure that terminal access is only\nenabled when necessary and properly authorized.", - "Attributes": [ - { - "FamilyName": "Identity and Access Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN04 Disable Terminal Access on MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Prevent users from accessing the terminal on MLDE instances to limit the risk of\nunauthorized commands and potential system compromise.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-4" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-6" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-08" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.2.3" - ] - } - ] - } - ], - "Checks": [ - "ec2_instance_port_ssh_exposed_to_internet", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22", - "ec2_securitygroup_allow_ingress_from_internet_to_all_ports", - "ec2_networkacl_allow_ingress_tcp_port_22", - "ec2_instance_public_ip", - "ec2_launch_template_no_public_ip", - "autoscaling_group_launch_configuration_no_public_ip" - ] - }, - { - "Id": "CCC.MLDE.CN02.AR01", - "Description": "Confirm that file download functionality is disabled on MLDE instances containing sensitive data.", - "Attributes": [ - { - "FamilyName": "Data Protection", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN02 Disable File Downloads on MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Prevent unauthorized file downloads from MLDE instances to protect sensitive data from being exfiltrated.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH02", - "CCC.TH02" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.DS-5" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "DSI-05", - "DSI-07" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.13.2.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-7", - "SC-8" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.MLDE.CN02.AR02", - "Description": "For MLDE instances without sensitive data, ensure that file downloads are monitored and logged.", - "Attributes": [ - { - "FamilyName": "Data Protection", - "FamilyDescription": "TODO: Describe this control family", - "Section": "", - "SubSection": "CCC.MLDE.CN02 Disable File Downloads on MLDE Instances", - "SubSectionObjective": "Prevent unauthorized file downloads from MLDE instances to protect sensitive data from being exfiltrated.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH02", - "CCC.TH02" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.DS-5" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "DSI-05", - "DSI-07" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.13.2.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-7", - "SC-8" - ] - } - ] - } - ], - "Checks": [ - "cloudtrail_s3_dataevents_read_enabled", - "cloudtrail_s3_dataevents_write_enabled", - "cloudtrail_kms_encryption_enabled", - "cloudtrail_cloudwatch_logging_enabled", - "cloudtrail_logs_s3_bucket_is_not_publicly_accessible" - ] - }, - { - "Id": "CCC.MLDE.CN05.AR01", - "Description": "Verify that only approved VM and container images can be selected when creating MLDE instances.", - "Attributes": [ - { - "FamilyName": "Configuration Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "", - "SubSection": "CCC.MLDE.CN05 Restrict Environment Options on MLDE Instances", - "SubSectionObjective": "Limit the virtual machine and container image options available when creating\nnew MLDE instances to approved and secure configurations.", - "Applicability": [ - "tlp-red", - "tlp-amber" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH04" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.IP-1" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "TVM-02" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.12.5.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "CM-2" - ] - } - ] - } - ], - "Checks": [ - "bedrock_guardrail_prompt_attack_filter_enabled", - "bedrock_guardrail_sensitive_information_filter_enabled", - "bedrock_model_invocation_logging_enabled", - "bedrock_model_invocation_logs_encryption_enabled", - "bedrock_agent_guardrail_enabled" - ] - }, - { - "Id": "CCC.MLDE.CN05.AR02", - "Description": "Attempt to create an MLDE instance with an unapproved image and confirm that it is denied.", - "Attributes": [ - { - "FamilyName": "Configuration Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "", - "SubSection": "CCC.MLDE.CN05 Restrict Environment Options on MLDE Instances", - "SubSectionObjective": "Limit the virtual machine and container image options available when creating\nnew MLDE instances to approved and secure configurations.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH04" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.IP-1" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "TVM-02" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.12.5.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "CM-2" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.MLDE.CN06.AR01", - "Description": "Verify that automatic scheduled upgrades are enabled on user-managed\nMLDE instances containing sensitive data.", - "Attributes": [ - { - "FamilyName": "Vulnerability Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "", - "SubSection": "CCC.MLDE.CN06 Require Automatic Scheduled Upgrades on User-Managed MLDE Instances", - "SubSectionObjective": "Ensure that MLDE instances are kept up-to-date with the\nlatest security patches by enforcing automatic scheduled upgrades.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH04", - "CCC.TH06" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.IP-12" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "TVM-01", - "TVM-02" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.12.6.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SI-2" - ] - } - ] - } - ], - "Checks": [ - "dms_instance_minor_version_upgrade_enabled", - "elasticache_redis_cluster_auto_minor_version_upgrades", - "memorydb_cluster_auto_minor_version_upgrades", - "mq_broker_auto_minor_version_upgrades", - "redshift_cluster_automatic_upgrades", - "rds_cluster_minor_version_upgrade_enabled", - "rds_instance_minor_version_upgrade_enabled" - ] - }, - { - "Id": "CCC.MLDE.CN06.AR02", - "Description": "Ensure that the upgrade schedule is appropriately configured and\ndoes not interfere with critical operations.", - "Attributes": [ - { - "FamilyName": "Vulnerability Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "", - "SubSection": "CCC.MLDE.CN06 Require Automatic Scheduled Upgrades on User-Managed MLDE Instances", - "SubSectionObjective": "Ensure that MLDE instances are kept up-to-date with the\nlatest security patches by enforcing automatic scheduled upgrades.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH04", - "CCC.TH06" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.IP-12" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "TVM-01", - "TVM-02" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.12.6.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SI-2" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.MLDE.CN07.AR01", - "Description": "Verify that MLDE instances containing sensitive data cannot be accessed via public IP addresses.", - "Attributes": [ - { - "FamilyName": "Network Security", - "FamilyDescription": "TODO: Describe this control family", - "Section": "", - "SubSection": "CCC.MLDE.CN07 Restrict Public IP Access on MLDE Instances", - "SubSectionObjective": "Prevent public IP access to MLDE instances to reduce exposure to the internet and enhance security.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH02", - "CCC.VPC.TH02" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-3" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "SEF-05" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.13.1.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-7" - ] - } - ] - } - ], - "Checks": [ - "ec2_instance_public_ip", - "ec2_securitygroup_allow_ingress_from_internet_to_all_ports" - ] - }, - { - "Id": "CCC.MLDE.CN07.AR02", - "Description": "For MLDE instances without sensitive data requiring public access,\nensure that appropriate security controls are in place and access is approved.", - "Attributes": [ - { - "FamilyName": "Network Security", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN07 Restrict Public IP Access on MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Prevent public IP access to MLDE instances to reduce exposure to the internet and enhance security.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH02", - "CCC.VPC.TH02" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-3" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "SEF-05" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.13.1.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-7" - ] - } - ] - } - ], - "Checks": [ - "ec2_instance_public_ip", - "ec2_instance_internet_facing_with_instance_profile", - "ec2_securitygroup_allow_ingress_from_internet_to_all_ports", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_ftp_20_21", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379", - "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601", - "ec2_networkacl_allow_ingress_tcp_port_22", - "ec2_networkacl_allow_ingress_tcp_port_3389", - "ec2_networkacl_allow_ingress_any_port" - ] - }, - { - "Id": "CCC.MLDE.CN08.AR01", - "Description": "Verify that MLDE instances containing sensitive data can only be deployed in\napproved virtual networks with appropriate security controls.", - "Attributes": [ - { - "FamilyName": "Network Security", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN08 Restrict Virtual Networks for MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Limit the virtual networks that can be used when creating new MLDE instances to\nensure they are deployed within approved and secure network environments.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01", - "CCC.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-4" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-12" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.1.2" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-6" - ] - } - ] - } - ], - "Checks": [ - "vpc_subnet_no_public_ip_by_default", - "vpc_subnet_different_az", - "vpc_flow_logs_enabled", - "vpc_endpoint_connections_trust_boundaries", - "vpc_peering_routing_tables_with_least_privilege" - ] - }, - { - "Id": "CCC.MLDE.CN08.AR02", - "Description": "Ensure that MLDE instances without sensitive data are deployed in\nnetworks that meet organizational security standards.", - "Attributes": [ - { - "FamilyName": "Network Security", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN08 Restrict Virtual Networks for MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Limit the virtual networks that can be used when creating new MLDE instances to\nensure they are deployed within approved and secure network environments.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01", - "CCC.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-4" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-12" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.1.2" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-6" - ] - } - ] - } - ], - "Checks": [ - "sagemaker_notebook_instance_without_direct_internet_access_configured", - "sagemaker_training_jobs_network_isolation_enabled", - "sagemaker_models_network_isolation_enabled", - "sagemaker_training_jobs_vpc_settings_configured", - "sagemaker_notebook_instance_vpc_settings_configured", - "sagemaker_notebook_instance_encryption_enabled" - ] - }, - { - "Id": "CCC.Message.CN01.AR01", - "Description": "Attempt to publish a message without using a customer-managed encryption key\nand verify that the message is rejected or not stored.", - "Attributes": [ - { - "FamilyName": "Encryption", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.Message.CN01 Use Customer-Managed Encryption Keys (CMEK) for Messages", - "SubSection": "", - "SubSectionObjective": "Ensure that messages are encrypted using customer-managed encryption keys (CMEK)\nto provide enhanced control over encryption processes and keys, meeting compliance and security requirements.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.DS-1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-12", - "SC-13" - ] - } - ] - } - ], - "Checks": [ - "firehose_stream_encrypted_at_rest", - "kinesis_stream_encrypted_at_rest" - ] - }, { "Id": "CCC.Monitor.CN01.AR01", - "Description": "When an External Monitoring system exceeds the anticipated rate of monitoring checks then\nRate Limiting MUST be applied and an Audit Alert MUST be generated.", + "Description": "When an External Monitoring system exceeds the anticipated rate of monitoring checks then Rate Limiting MUST be applied and an Audit Alert MUST be generated.", "Attributes": [ { "FamilyName": "Logging & Monitoring", @@ -4769,7 +3032,7 @@ }, { "Id": "CCC.Monitor.CN02.AR01", - "Description": "When an Custom or User-Defined Metric starts to flood a collector, then a rate limit MUST be applied\nto reduce the network impact of traffic and an alert must triggered.", + "Description": "When an Custom or User-Defined Metric starts to flood a collector, then a rate limit MUST be applied to reduce the network impact of traffic and an alert must triggered.", "Attributes": [ { "FamilyName": "Logging & Monitoring", @@ -4828,14 +3091,14 @@ }, { "Id": "CCC.Monitor.CN03.AR01", - "Description": "When external systems have approved access to internal systems not normally available for public access\nthen they MUST be secured to prevent unauthorised access jumping through to the internal systems and\nonly allow access to specific internal services.", + "Description": "When external systems have approved access to internal systems not normally available for public access then they MUST be secured to prevent unauthorised access jumping through to the internal systems and only allow access to specific internal services.", "Attributes": [ { "FamilyName": "Identity and Access Management", "FamilyDescription": "Controls designed to prevent unauthorised access to monitoring features.", "Section": "CCC.Monitor.CN03 Access External Monitoring", "SubSection": "", - "SubSectionObjective": "Control access to Synthetic monitoring solutions using API keys or Certificate based authentication to\nensure they don't become an attack path, preventing monitoring systems from forging network requests to\ngain access to internal systems.", + "SubSectionObjective": "Control access to Synthetic monitoring solutions using API keys or Certificate based authentication to ensure they don't become an attack path, preventing monitoring systems from forging network requests to gain access to internal systems.", "Applicability": [ "tlp-clear", "tlp-green", @@ -4880,7 +3143,7 @@ }, { "Id": "CCC.Monitor.CN04.AR01", - "Description": "When monitoring dashboards display degraded services which may become potential targets then the\ndashboard MUST be protected from unauthorised access.", + "Description": "When monitoring dashboards display degraded services which may become potential targets then the dashboard MUST be protected from unauthorised access.", "Attributes": [ { "FamilyName": "Identity and Access Management", @@ -4930,7 +3193,7 @@ }, { "Id": "CCC.Monitor.CN05.AR01", - "Description": "When monitoring services have generated an alert, the service MUST ensure only authorised\nresponders silence or acknowledge the alert.", + "Description": "When monitoring services have generated an alert, the service MUST ensure only authorised responders silence or acknowledge the alert.", "Attributes": [ { "FamilyName": "Identity and Access Management", @@ -4988,7 +3251,7 @@ "FamilyDescription": "Controls designed to prevent unauthorised access to monitoring features.", "Section": "CCC.Monitor.CN06 Metrics pushed for authorised services only", "SubSection": "", - "SubSectionObjective": "Use IAM to control which types of metrics or traces can be pushed by different system to avoid a compromised\nsystem pushing fabricated metrics about a different service", + "SubSectionObjective": "Use IAM to control which types of metrics or traces can be pushed by different system to avoid a compromised system pushing fabricated metrics about a different service", "Applicability": [ "tlp-clear", "tlp-green", @@ -5030,189 +3293,16 @@ "cloudwatch_log_group_not_publicly_accessible" ] }, - { - "Id": "CCC.SecMgmt.CN01.AR01", - "Description": "Attempt to use an outdated version of a secret after its rotation period\nhas passed and verify that access is denied.", - "Attributes": [ - { - "FamilyName": "Data Protection", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.SecMgmt.CN01 Enforce Automatic Secret Rotation", - "SubSection": "", - "SubSectionObjective": "Ensure that secrets are automatically rotated on a defined schedule to\nreduce the risk of secret compromise and unauthorized access.", - "Applicability": [ - "tlp-red", - "tlp-amber" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.TH01", - "CCC.TH14" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.DS-6" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-12", - "SC-28" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.SecMgmt.CN02.AR01", - "Description": "Attempt to retrieve a secret from an unauthorized region and verify that access is denied.", - "Attributes": [ - { - "FamilyName": "Data Protection", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.SecMgmt.CN02 Enforce Secret Replication Policies", - "SubSection": "", - "SubSectionObjective": "Ensure that secrets are replicated only to authorized locations as per\norganizational data residency and compliance requirements.", - "Applicability": [ - "tlp-red", - "tlp-amber" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.TH03", - "CCC.TH04" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.DS-5" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-3", - "SC-7" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.SvlsComp.CN01.AR01", - "Description": "Attempt to access the serverless function over the public internet and verify that access is denied.", - "Attributes": [ - { - "FamilyName": "Network Security", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.SvlsComp.CN01 Enforce Use of Private Endpoints for Serverless Function", - "SubSection": "", - "SubSectionObjective": "Ensure that the serverless function is accessible only through a private endpoint,\nallowing it to communicate securely within a virtual private network and preventing\nunauthorized external access.", - "Applicability": [ - "tlp-red", - "tlp-amber" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-5" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-7", - "SC-8" - ] - } - ] - } - ], - "Checks": [ - "awslambda_function_url_public", - "awslambda_function_not_publicly_accessible", - "awslambda_function_inside_vpc" - ] - }, - { - "Id": "CCC.SvlsComp.CN02.AR01", - "Description": "Send requests to invoke the function up to the allowed threshold and confirm they\nare successful; then send additional requests exceeding the threshold from the same\nentity and verify that they are denied.", - "Attributes": [ - { - "FamilyName": "Availability", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.SvlsComp.CN02 Implement Function Invocation Rate Limits", - "SubSection": "", - "SubSectionObjective": "Ensure that function invocation is limited to a specified threshold from any single entity,\npreventing resource exhaustion and denial of service attacks.", - "Applicability": [ - "tlp-red", - "tlp-amber" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.TH12" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.DS-4" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-5" - ] - } - ] - } - ], - "Checks": [] - }, { "Id": "CCC.VPC.CN01.AR01", - "Description": "When a subscription is created, the subscription MUST NOT\ncontain default network resources.", + "Description": "When a subscription is created, the subscription MUST NOT contain default network resources.", "Attributes": [ { "FamilyName": "Network Security", "FamilyDescription": "TODO: Describe this control family", "Section": "CCC.VPC.CN01 Restrict Default Network Creation", "SubSection": "", - "SubSectionObjective": "Restrict the automatic creation of default virtual networks and related\nresources during subscription initialization to avoid insecure default\nconfigurations and enforce custom network policies.", + "SubSectionObjective": "Restrict the automatic creation of default virtual networks and related resources during subscription initialization to avoid insecure default configurations and enforce custom network policies.", "Applicability": [ "tlp-amber", "tlp-red" @@ -5260,72 +3350,16 @@ "ec2_securitygroup_allow_ingress_from_internet_to_any_port" ] }, - { - "Id": "CCC.VPC.CN02.AR01", - "Description": "When a resource is created in a public subnet, that resource\nMUST NOT be assigned an external IP address by default.", - "Attributes": [ - { - "FamilyName": "Network Security", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.VPC.CN02 Limit Resource Creation in Public Subnet", - "SubSection": "", - "SubSectionObjective": "Restrict the creation of resources in the public subnet with\ndirect access to the internet to minimize attack surfaces.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.VPC.TH02" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-3" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "SEF-05" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.13.1.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-4" - ] - } - ] - } - ], - "Checks": [ - "vpc_subnet_no_public_ip_by_default", - "ec2_launch_template_no_public_ip", - "autoscaling_group_launch_configuration_no_public_ip" - ] - }, { "Id": "CCC.VPC.CN03.AR01", - "Description": "When a VPC peering connection is requested, the service MUST\nprevent connections from VPCs that are not explicitly\nallowed.", + "Description": "When a VPC peering connection is requested, the service MUST prevent connections from VPCs that are not explicitly allowed.", "Attributes": [ { "FamilyName": "Network Security", "FamilyDescription": "TODO: Describe this control family", "Section": "CCC.VPC.CN03 Restrict VPC Peering to Authorized Accounts", "SubSection": "", - "SubSectionObjective": "Ensure VPC peering connections are only established with explicitly\nauthorized destinations to limit network exposure and enforce boundary\ncontrols.", + "SubSectionObjective": "Ensure VPC peering connections are only established with explicitly authorized destinations to limit network exposure and enforce boundary controls.", "Applicability": [ "tlp-green", "tlp-amber", @@ -5374,14 +3408,14 @@ }, { "Id": "CCC.VPC.CN04.AR01", - "Description": "When any network traffic goes to or from an interface in the VPC,\nthe service MUST capture and log all relevant information.", + "Description": "When any network traffic goes to or from an interface in the VPC, the service MUST capture and log all relevant information.", "Attributes": [ { "FamilyName": "Network Security", "FamilyDescription": "TODO: Describe this control family", "Section": "CCC.VPC.CN04 Enforce VPC Flow Logs on VPCs", "SubSection": "", - "SubSectionObjective": "Ensure VPCs are configured with flow logs enabled to capture traffic\ninformation.", + "SubSectionObjective": "Ensure VPCs are configured with flow logs enabled to capture traffic information.", "Applicability": [ "tlp-amber", "tlp-red" @@ -5429,14 +3463,14 @@ }, { "Id": "CCC.Vector.CN01.AR01", - "Description": "When a vector embedding is submitted for indexing, the system MUST validate that it\nmatches expected schema, dimension, and format profiles.", + "Description": "When a vector embedding is submitted for indexing, the system MUST validate that it matches expected schema, dimension, and format profiles.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN01 Validate Embeddings Before Indexing", "SubSection": "", - "SubSectionObjective": "Ensure all incoming embeddings are structurally and statistically validated\nbefore indexing to prevent poisoning or corruption.", + "SubSectionObjective": "Ensure all incoming embeddings are structurally and statistically validated before indexing to prevent poisoning or corruption.", "Applicability": [ "tlp-clear", "tlp-green", @@ -5468,14 +3502,14 @@ }, { "Id": "CCC.Vector.CN02.AR01", - "Description": "When an index lifecycle event is triggered, the service MUST\nverify that the actor has explicit permissions for the operation type.", + "Description": "When an index lifecycle event is triggered, the service MUST verify that the actor has explicit permissions for the operation type.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN02 Enforce Role-Based Index Lifecycle Management", "SubSection": "", - "SubSectionObjective": "Restrict index lifecycle operations (create, delete, rollback) to privileged\nidentities using fine-grained access controls.", + "SubSectionObjective": "Restrict index lifecycle operations (create, delete, rollback) to privileged identities using fine-grained access controls.", "Applicability": [ "tlp-clear", "tlp-green", @@ -5519,14 +3553,14 @@ }, { "Id": "CCC.Vector.CN03.AR01", - "Description": "When a metadata filter is applied to a query, the service MUST\nverify the requester is authorized to access that field.", + "Description": "When a metadata filter is applied to a query, the service MUST verify the requester is authorized to access that field.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN03 Enforce Metadata-Level Access Controls", "SubSection": "", - "SubSectionObjective": "Apply access control policies to metadata fields used in filtering to\nprevent unauthorized exposure or inference.", + "SubSectionObjective": "Apply access control policies to metadata fields used in filtering to prevent unauthorized exposure or inference.", "Applicability": [ "tlp-amber", "tlp-red" @@ -5557,14 +3591,14 @@ }, { "Id": "CCC.Vector.CN04.AR01", - "Description": "When ingestion exceeds pre-defined thresholds, the service MUST\nthrottle or reject excess vector write operations.", + "Description": "When ingestion exceeds pre-defined thresholds, the service MUST throttle or reject excess vector write operations.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN04 Enforce Ingestion Quotas and Throttling", "SubSection": "", - "SubSectionObjective": "Prevent ingestion-based DoS or index pollution by\nrate-limiting vector submissions and enforcing quotas.", + "SubSectionObjective": "Prevent ingestion-based DoS or index pollution by rate-limiting vector submissions and enforcing quotas.", "Applicability": [ "tlp-green", "tlp-amber", @@ -5594,14 +3628,14 @@ }, { "Id": "CCC.Vector.CN05.AR01", - "Description": "When a rollback is attempted, the system MUST log\nthe action and verify rollback authorization.", + "Description": "When a rollback is attempted, the system MUST log the action and verify rollback authorization.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN05 Enforce Index Versioning with Rollback Protection", "SubSection": "", - "SubSectionObjective": "Ensure vector indexes are versioned and that rollback\noperations are authorized and auditable.", + "SubSectionObjective": "Ensure vector indexes are versioned and that rollback operations are authorized and auditable.", "Applicability": [ "tlp-amber", "tlp-red" @@ -5631,14 +3665,14 @@ }, { "Id": "CCC.Vector.CN06.AR01", - "Description": "When an embedding is submitted, the service MUST validate\nthat its format and dimensionality match allowed profiles.", + "Description": "When an embedding is submitted, the service MUST validate that its format and dimensionality match allowed profiles.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN06 Enforce Dimensional and Format Constraints", "SubSection": "", - "SubSectionObjective": "Reject embeddings that do not conform to expected model\nspecifications (dimensions, format, etc).", + "SubSectionObjective": "Reject embeddings that do not conform to expected model specifications (dimensions, format, etc).", "Applicability": [ "tlp-clear", "tlp-green", @@ -5669,14 +3703,14 @@ }, { "Id": "CCC.Vector.CN07.AR01", - "Description": "When a search request is issued, clients MUST be allowed\nto declare their requirement for exact vs approximate results.", + "Description": "When a search request is issued, clients MUST be allowed to declare their requirement for exact vs approximate results.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN07 Support Explicit ANN vs. Exact Search Configuration", "SubSection": "", - "SubSectionObjective": "Provide clients with the option to enforce exact-match\n(non-ANN) search where search fidelity is critical.", + "SubSectionObjective": "Provide clients with the option to enforce exact-match (non-ANN) search where search fidelity is critical.", "Applicability": [ "tlp-amber", "tlp-red" @@ -5697,20 +3731,20 @@ }, { "Id": "CCC.Core.CN01.AR01", - "Description": "When a port is exposed for non-SSH network traffic, all traffic\nMUST include a TLS handshake AND be encrypted using TLS 1.3 or\nhigher.", + "Description": "When a port is exposed for non-SSH network traffic, all traffic MUST include a TLS handshake AND be encrypted using TLS 1.3 or higher.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN01 Encrypt Data for Transmission", "SubSection": "", - "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect\ndata integrity and confidentiality.", + "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect data integrity and confidentiality.", "Applicability": [ "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Most cloud services enable TLS 1.3 by default. Where it is not\nalready set, ensure that your services are configured or updated\naccordingly.\n", + "Recommendation": "Most cloud services enable TLS 1.3 by default. Where it is not already set, ensure that your services are configured or updated accordingly. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -5765,21 +3799,21 @@ }, { "Id": "CCC.Core.CN01.AR02", - "Description": "When a port is exposed for SSH network traffic, all traffic MUST\ninclude a SSH handshake AND be encrypted using SSHv2 or higher.", + "Description": "When a port is exposed for SSH network traffic, all traffic MUST include a SSH handshake AND be encrypted using SSHv2 or higher.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN01 Encrypt Data for Transmission", "SubSection": "", - "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect\ndata integrity and confidentiality.", + "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect data integrity and confidentiality.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Any time port 22 is exposed, ensure that it has a properly\nimplemented SSH server with SSHv2 enabled and configured with\nstrong ciphers.\n", + "Recommendation": "Any time port 22 is exposed, ensure that it has a properly implemented SSH server with SSHv2 enabled and configured with strong ciphers. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -5829,20 +3863,20 @@ }, { "Id": "CCC.Core.CN01.AR03", - "Description": "When the service receives unencrypted traffic, \nthen it MUST either block the request or automatically\nredirect it to the secure equivalent.", + "Description": "When the service receives unencrypted traffic, then it MUST either block the request or automatically redirect it to the secure equivalent.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN01 Encrypt Data for Transmission", "SubSection": "", - "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect\ndata integrity and confidentiality.", + "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect data integrity and confidentiality.", "Applicability": [ "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Review firewall, load balancer, and application configurations to\nensure insecure protocols such as HTTP, FTP, and Telnet are not\nexposed. Where possible, implement automatic redirection to secure\nprotocols such as HTTPS, SFTP, SSH, and regularly scan for\nprotocol drift.\n", + "Recommendation": "Review firewall, load balancer, and application configurations to ensure insecure protocols such as HTTP, FTP, and Telnet are not exposed. Where possible, implement automatic redirection to secure protocols such as HTTPS, SFTP, SSH, and regularly scan for protocol drift. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -5896,21 +3930,21 @@ }, { "Id": "CCC.Core.CN01.AR07", - "Description": "When a port is exposed, the service MUST ensure that the protocol\nand service officially assigned to that port number by the IANA\nService Name and Transport Protocol Port Number Registry, and no\nother, is run on that port.", + "Description": "When a port is exposed, the service MUST ensure that the protocol and service officially assigned to that port number by the IANA Service Name and Transport Protocol Port Number Registry, and no other, is run on that port.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN01 Encrypt Data for Transmission", "SubSection": "", - "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect\ndata integrity and confidentiality.", + "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect data integrity and confidentiality.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Reference the IANA Service Name and Transport Protocol Port Number\nRegistry for more information about correct protocol-to-port\nassignments. Avoid running non-standard services on well-known\nports.\n", + "Recommendation": "Reference the IANA Service Name and Transport Protocol Port Number Registry for more information about correct protocol-to-port assignments. Avoid running non-standard services on well-known ports. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -5964,19 +3998,19 @@ }, { "Id": "CCC.Core.CN01.AR08", - "Description": "When a service transmits data using TLS, mutual TLS (mTLS) MUST be\nimplemented to require both client and server certificate\nauthentication for all connections.", + "Description": "When a service transmits data using TLS, mutual TLS (mTLS) MUST be implemented to require both client and server certificate authentication for all connections.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN01 Encrypt Data for Transmission", "SubSection": "", - "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect\ndata integrity and confidentiality.", + "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect data integrity and confidentiality.", "Applicability": [ "tlp-amber", "tlp-red" ], - "Recommendation": "Configure mTLS for all endpoints that process or transmit\nsensitive data. Ensure both client and server certificates are\nvalidated and managed securely. Regularly review certificate\nauthorities and automate certificate rotation where possible.\n", + "Recommendation": "Configure mTLS for all endpoints that process or transmit sensitive data. Ensure both client and server certificates are validated and managed securely. Regularly review certificate authorities and automate certificate rotation where possible. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6035,21 +4069,21 @@ }, { "Id": "CCC.Core.CN13.AR01", - "Description": "When a port is exposed that uses certificate-based encryption,\nthe service MUST only use valid, unexpired certificates issued by\na trusted certificate authority.", + "Description": "When a port is exposed that uses certificate-based encryption, the service MUST only use valid, unexpired certificates issued by a trusted certificate authority.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN13 Minimize Lifetime of Encryption and Authentication Certificates", "SubSection": "", - "SubSectionObjective": "Ensure that encryption and authentication certificates have a limited\nlifetime to reduce the risk of compromise and ensure the use of\nup-to-date security practices.", + "SubSectionObjective": "Ensure that encryption and authentication certificates have a limited lifetime to reduce the risk of compromise and ensure the use of up-to-date security practices.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Track certificate expiration dates and automate certificate\nrenewal where possible. Use certificate management tools to ensure\nonly certificates from trusted authorities are deployed.\n", + "Recommendation": "Track certificate expiration dates and automate certificate renewal where possible. Use certificate management tools to ensure only certificates from trusted authorities are deployed. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6069,18 +4103,18 @@ }, { "Id": "CCC.Core.CN13.AR02", - "Description": "When a port is exposed that uses certificate-based encryption,\nthe service MUST rotate active certificates within 180 days of\nissuance.", + "Description": "When a port is exposed that uses certificate-based encryption, the service MUST rotate active certificates within 180 days of issuance.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN13 Minimize Lifetime of Encryption and Authentication Certificates", "SubSection": "", - "SubSectionObjective": "Ensure that encryption and authentication certificates have a limited\nlifetime to reduce the risk of compromise and ensure the use of\nup-to-date security practices.", + "SubSectionObjective": "Ensure that encryption and authentication certificates have a limited lifetime to reduce the risk of compromise and ensure the use of up-to-date security practices.", "Applicability": [ "tlp-amber" ], - "Recommendation": "Track certificate expiration dates and automate certificate\nrenewal where possible. Use certificate management tools to ensure\nonly certificates from trusted authorities are deployed.\n", + "Recommendation": "Track certificate expiration dates and automate certificate renewal where possible. Use certificate management tools to ensure only certificates from trusted authorities are deployed. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6098,18 +4132,18 @@ }, { "Id": "CCC.Core.CN13.AR03", - "Description": "When a port is exposed that uses certificate-based encryption,\nthe service MUST rotate active certificates within 90 days of\nissuance.", + "Description": "When a port is exposed that uses certificate-based encryption, the service MUST rotate active certificates within 90 days of issuance.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN13 Minimize Lifetime of Encryption and Authentication Certificates", "SubSection": "", - "SubSectionObjective": "Ensure that encryption and authentication certificates have a limited\nlifetime to reduce the risk of compromise and ensure the use of\nup-to-date security practices.", + "SubSectionObjective": "Ensure that encryption and authentication certificates have a limited lifetime to reduce the risk of compromise and ensure the use of up-to-date security practices.", "Applicability": [ "tlp-red" ], - "Recommendation": "Track certificate expiration dates and automate certificate\nrenewal where possible. Use certificate management tools to ensure\nonly certificates from trusted authorities are deployed.\n", + "Recommendation": "Track certificate expiration dates and automate certificate renewal where possible. Use certificate management tools to ensure only certificates from trusted authorities are deployed. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6127,21 +4161,21 @@ }, { "Id": "CCC.Core.CN06.AR01", - "Description": "When the service is running, its region and availability zone MUST\nbe included in a list of explicitly trusted or approved locations\nwithin the trust perimeter.", + "Description": "When the service is running, its region and availability zone MUST be included in a list of explicitly trusted or approved locations within the trust perimeter.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN06 Restrict Deployments to Trust Perimeter", "SubSection": "", - "SubSectionObjective": "Ensure that the service and its child resources are only deployed on\ninfrastructure in locations that are explicitly included within a\ndefined trust perimeter.", + "SubSectionObjective": "Ensure that the service and its child resources are only deployed on infrastructure in locations that are explicitly included within a defined trust perimeter.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Maintain an up-to-date list of trusted and approved regions based\non organizational policies. Validate the service's deployment\nlocation is included in this list.\n", + "Recommendation": "Maintain an up-to-date list of trusted and approved regions based on organizational policies. Validate the service's deployment location is included in this list. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6186,21 +4220,21 @@ }, { "Id": "CCC.Core.CN06.AR02", - "Description": "When a child resource is deployed, its region and availability\nzone MUST be included in a list of explicitly trusted or approved\nlocations within the trust perimeter.", + "Description": "When a child resource is deployed, its region and availability zone MUST be included in a list of explicitly trusted or approved locations within the trust perimeter.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN06 Restrict Deployments to Trust Perimeter", "SubSection": "", - "SubSectionObjective": "Ensure that the service and its child resources are only deployed on\ninfrastructure in locations that are explicitly included within a\ndefined trust perimeter.", + "SubSectionObjective": "Ensure that the service and its child resources are only deployed on infrastructure in locations that are explicitly included within a defined trust perimeter.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Maintain an up-to-date list of trusted and approved regions based\non organizational policies. Validate that child resources can only\nbe deployed to locations included in this list.\n", + "Recommendation": "Maintain an up-to-date list of trusted and approved regions based on organizational policies. Validate that child resources can only be deployed to locations included in this list. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6245,20 +4279,20 @@ }, { "Id": "CCC.Core.CN08.AR01", - "Description": "When data is created or modified, the data MUST have a complete\nand recoverable duplicate that is stored in a physically separate\ndata center.", + "Description": "When data is created or modified, the data MUST have a complete and recoverable duplicate that is stored in a physically separate data center.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN08 Replicate Data to Multiple Locations", "SubSection": "", - "SubSectionObjective": "Ensure that data is replicated across multiple physical locations to\nprotect against data loss due to hardware failures, natural disasters,\nor other catastrophic events.", + "SubSectionObjective": "Ensure that data is replicated across multiple physical locations to protect against data loss due to hardware failures, natural disasters, or other catastrophic events.", "Applicability": [ "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Implement automated data replication processes to ensure that\ndata is consistently duplicated in another region or availability\nzone. Regularly test data recovery from the replicated location to\nensure integrity and availability.\n", + "Recommendation": "Implement automated data replication processes to ensure that data is consistently duplicated in another region or availability zone. Regularly test data recovery from the replicated location to ensure integrity and availability. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6305,14 +4339,14 @@ }, { "Id": "CCC.Core.CN08.AR02", - "Description": "When data is replicated into a second location, the service MUST\nbe able to accurately represent the replication locations,\nreplication status, and data synchronization status.", + "Description": "When data is replicated into a second location, the service MUST be able to accurately represent the replication locations, replication status, and data synchronization status.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN08 Replicate Data to Multiple Locations", "SubSection": "", - "SubSectionObjective": "Ensure that data is replicated across multiple physical locations to\nprotect against data loss due to hardware failures, natural disasters,\nor other catastrophic events.", + "SubSectionObjective": "Ensure that data is replicated across multiple physical locations to protect against data loss due to hardware failures, natural disasters, or other catastrophic events.", "Applicability": [ "tlp-green", "tlp-amber", @@ -6358,14 +4392,14 @@ }, { "Id": "CCC.Core.CN09.AR01", - "Description": "When the service is operational, its logs and any child resource\nlogs MUST NOT be accessible from the resource they record access\nto.", + "Description": "When the service is operational, its logs and any child resource logs MUST NOT be accessible from the resource they record access to.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN09 Ensure Integrity of Access Logs", "SubSection": "", - "SubSectionObjective": "Ensure that access logs are always recorded to an external location\nthat cannot be manipulated from the context of the service(s) it\ncontains logs for.", + "SubSectionObjective": "Ensure that access logs are always recorded to an external location that cannot be manipulated from the context of the service(s) it contains logs for.", "Applicability": [ "tlp-clear", "tlp-green", @@ -6420,21 +4454,21 @@ }, { "Id": "CCC.Core.CN09.AR02", - "Description": "When the service is operational, disabling the logs for the service\nor its child resources MUST NOT be possible without also disabling\nthe corresponding resource.", + "Description": "When the service is operational, disabling the logs for the service or its child resources MUST NOT be possible without also disabling the corresponding resource.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN09 Ensure Integrity of Access Logs", "SubSection": "", - "SubSectionObjective": "Ensure that access logs are always recorded to an external location\nthat cannot be manipulated from the context of the service(s) it\ncontains logs for.", + "SubSectionObjective": "Ensure that access logs are always recorded to an external location that cannot be manipulated from the context of the service(s) it contains logs for.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "No normal business operations should disable\nlogs, as this could indicate an attempt to cover up unauthorized\naccess. Ensure that logging mechanisms are tightly integrated with\nservice operations, so that logging cannot be disabled without\nstopping the service itself.\n", + "Recommendation": "No normal business operations should disable logs, as this could indicate an attempt to cover up unauthorized access. Ensure that logging mechanisms are tightly integrated with service operations, so that logging cannot be disabled without stopping the service itself. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6486,19 +4520,19 @@ }, { "Id": "CCC.Core.CN09.AR03", - "Description": "When the service is operational, any attempt to redirect logs for\nthe service or its child resources MUST NOT be possible without\nhalting operation of the corresponding resource and publishing\ncorresponding events to monitored channels.", + "Description": "When the service is operational, any attempt to redirect logs for the service or its child resources MUST NOT be possible without halting operation of the corresponding resource and publishing corresponding events to monitored channels.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN09 Ensure Integrity of Access Logs", "SubSection": "", - "SubSectionObjective": "Ensure that access logs are always recorded to an external location\nthat cannot be manipulated from the context of the service(s) it\ncontains logs for.", + "SubSectionObjective": "Ensure that access logs are always recorded to an external location that cannot be manipulated from the context of the service(s) it contains logs for.", "Applicability": [ "tlp-amber", "tlp-red" ], - "Recommendation": "No normal business operations should result in the redirection of\nlogs, as this could indicate an attempt to cover up unauthorized\naccess. Ensure that logging configurations are immutable during\nservice operation so that any changes require stopping the service\nand publishing corresponding events to monitored channels.\n", + "Recommendation": "No normal business operations should result in the redirection of logs, as this could indicate an attempt to cover up unauthorized access. Ensure that logging configurations are immutable during service operation so that any changes require stopping the service and publishing corresponding events to monitored channels. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6554,14 +4588,14 @@ }, { "Id": "CCC.Core.CN10.AR01", - "Description": "When data is replicated, the service MUST ensure that replication\nonly occurs to destinations that are explicitly included within\nthe defined trust perimeter.", + "Description": "When data is replicated, the service MUST ensure that replication only occurs to destinations that are explicitly included within the defined trust perimeter.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN10 Restrict Data Replication to Trust Perimeter", "SubSection": "", - "SubSectionObjective": "Ensure that data is only replicated on infrastructure in locations\nthat are explicitly included within a defined trust perimeter.", + "SubSectionObjective": "Ensure that data is only replicated on infrastructure in locations that are explicitly included within a defined trust perimeter.", "Applicability": [ "tlp-green", "tlp-amber", @@ -6607,14 +4641,14 @@ }, { "Id": "CCC.Core.CN02.AR01", - "Description": "When data is stored, it MUST be encrypted using the latest\nindustry-standard encryption methods.", + "Description": "When data is stored, it MUST be encrypted using the latest industry-standard encryption methods.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN02 Encrypt Data for Storage", "SubSection": "", - "SubSectionObjective": "Ensure that all data stored is encrypted at rest using strong\nencryption algorithms.", + "SubSectionObjective": "Ensure that all data stored is encrypted at rest using strong encryption algorithms.", "Applicability": [ "tlp-green", "tlp-amber", @@ -6676,14 +4710,14 @@ }, { "Id": "CCC.Core.CN11.AR01", - "Description": "When encryption keys are used, the service MUST verify that\nall encryption keys use the latest industry-standard cryptographic\nalgorithms.", + "Description": "When encryption keys are used, the service MUST verify that all encryption keys use the latest industry-standard cryptographic algorithms.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN11 Protect Encryption Keys", "SubSection": "", - "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing\nthe use of approved algorithms, regular key rotation, and\ncustomer-managed encryption keys (CMEKs).", + "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).", "Applicability": [ "tlp-amber", "tlp-red" @@ -6737,14 +4771,14 @@ }, { "Id": "CCC.Core.CN11.AR02", - "Description": "When encryption keys are used, the service MUST rotate active keys\nwithin 180 days of issuance.", + "Description": "When encryption keys are used, the service MUST rotate active keys within 180 days of issuance.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN11 Protect Encryption Keys", "SubSection": "", - "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing\nthe use of approved algorithms, regular key rotation, and\ncustomer-managed encryption keys (CMEKs).", + "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).", "Applicability": [ "tlp-amber" ], @@ -6797,14 +4831,14 @@ }, { "Id": "CCC.Core.CN11.AR03", - "Description": "When encrypting data, the service MUST verify that\ncustomer-managed encryption keys (CMEKs) are used.", + "Description": "When encrypting data, the service MUST verify that customer-managed encryption keys (CMEKs) are used.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "", "SubSection": "CCC.Core.CN11 Protect Encryption Keys", - "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing\nthe use of approved algorithms, regular key rotation, and\ncustomer-managed encryption keys (CMEKs).", + "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).", "Applicability": [ "tlp-amber", "tlp-red" @@ -6858,14 +4892,14 @@ }, { "Id": "CCC.Core.CN11.AR04", - "Description": "When encryption keys are accessed, the service MUST verify that\naccess to encryption keys is restricted to authorized personnel\nand services, following the principle of least privilege.", + "Description": "When encryption keys are accessed, the service MUST verify that access to encryption keys is restricted to authorized personnel and services, following the principle of least privilege.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN11 Protect Encryption Keys", "SubSection": "", - "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing\nthe use of approved algorithms, regular key rotation, and\ncustomer-managed encryption keys (CMEKs).", + "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).", "Applicability": [ "tlp-clear", "tlp-green", @@ -6921,14 +4955,14 @@ }, { "Id": "CCC.Core.CN11.AR05", - "Description": "When encryption keys are used, the service MUST rotate active keys\nwithin 365 days of issuance.", + "Description": "When encryption keys are used, the service MUST rotate active keys within 365 days of issuance.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN11 Protect Encryption Keys", "SubSection": "", - "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing\nthe use of approved algorithms, regular key rotation, and\ncustomer-managed encryption keys (CMEKs).", + "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).", "Applicability": [ "tlp-clear", "tlp-green" @@ -6980,14 +5014,14 @@ }, { "Id": "CCC.Core.CN11.AR06", - "Description": "When encryption keys are used, the service MUST rotate active keys\nwithin 90 days of issuance.", + "Description": "When encryption keys are used, the service MUST rotate active keys within 90 days of issuance.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN11 Protect Encryption Keys", "SubSection": "", - "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing\nthe use of approved algorithms, regular key rotation, and\ncustomer-managed encryption keys (CMEKs).", + "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).", "Applicability": [ "tlp-red" ], @@ -7037,21 +5071,21 @@ }, { "Id": "CCC.Core.CN14.AR01", - "Description": "When backups are created for disaster recovery purposes, the\nstorage mechanism MUST NOT allow modification or deletion\nwithin 30 days of creation.", + "Description": "When backups are created for disaster recovery purposes, the storage mechanism MUST NOT allow modification or deletion within 30 days of creation.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN14 Maintain Recent Backups", "SubSection": "", - "SubSectionObjective": "Ensure that all backups used for disaster recovery are recent and\nsubject to a retention policy that limits deletion.", + "SubSectionObjective": "Ensure that all backups used for disaster recovery are recent and subject to a retention policy that limits deletion.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Use immutable storage solutions where possible. Implement backup\nretention policies that enforce a minimum retention period of 30\ndays.\n", + "Recommendation": "Use immutable storage solutions where possible. Implement backup retention policies that enforce a minimum retention period of 30 days. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -7069,20 +5103,20 @@ }, { "Id": "CCC.Core.CN14.AR02", - "Description": "When backups are created for disaster recovery purposes, the\nmost recent backup MUST have a creation date within the past\n30 days.", + "Description": "When backups are created for disaster recovery purposes, the most recent backup MUST have a creation date within the past 30 days.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN14 Maintain Recent Backups", "SubSection": "", - "SubSectionObjective": "Ensure that all backups used for disaster recovery are recent and\nsubject to a retention policy that limits deletion.", + "SubSectionObjective": "Ensure that all backups used for disaster recovery are recent and subject to a retention policy that limits deletion.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber" ], - "Recommendation": "Implement automated backup processes to ensure that backups are\ncreated regularly. Monitor backup schedules and verify that the\nmost recent backup creation date is within the last 30 days.\n", + "Recommendation": "Implement automated backup processes to ensure that backups are created regularly. Monitor backup schedules and verify that the most recent backup creation date is within the last 30 days. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -7109,18 +5143,18 @@ }, { "Id": "CCC.Core.CN14.AR02", - "Description": "When backups are created for disaster recovery purposes, the\nmost recent backup MUST have a creation date within the past\n14 days.", + "Description": "When backups are created for disaster recovery purposes, the most recent backup MUST have a creation date within the past 14 days.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN14 Maintain Recent Backups", "SubSection": "", - "SubSectionObjective": "Ensure that all backups used for disaster recovery are recent and\nsubject to a retention policy that limits deletion.", + "SubSectionObjective": "Ensure that all backups used for disaster recovery are recent and subject to a retention policy that limits deletion.", "Applicability": [ "tlp-red" ], - "Recommendation": "Implement automated backup processes to ensure that backups are\ncreated regularly. Monitor backup schedules and verify that the\nmost recent backup creation date is within the last 14 days.\n", + "Recommendation": "Implement automated backup processes to ensure that backups are created regularly. Monitor backup schedules and verify that the most recent backup creation date is within the last 14 days. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -7143,14 +5177,14 @@ }, { "Id": "CCC.Core.CN03.AR01", - "Description": "When an entity attempts to modify the service through a user\ninterface, the authentication process MUST require multiple\nidentifying factors for authentication.", + "Description": "When an entity attempts to modify the service through a user interface, the authentication process MUST require multiple identifying factors for authentication.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN03 Implement Multi-factor Authentication (MFA) for Access", "SubSection": "", - "SubSectionObjective": "Ensure that all sensitive activities require two or more identity\nfactors during authentication to prevent unauthorized access.", + "SubSectionObjective": "Ensure that all sensitive activities require two or more identity factors during authentication to prevent unauthorized access.", "Applicability": [ "tlp-clear", "tlp-green", @@ -7211,14 +5245,14 @@ }, { "Id": "CCC.Core.CN03.AR02", - "Description": "When an entity attempts to modify the service through an API\nendpoint, the authentication process MUST require a credential\nsuch as an API key or token AND originate from within the trust\nperimeter.", + "Description": "When an entity attempts to modify the service through an API endpoint, the authentication process MUST require a credential such as an API key or token AND originate from within the trust perimeter.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN03 Implement Multi-factor Authentication (MFA) for Access", "SubSection": "", - "SubSectionObjective": "Ensure that all sensitive activities require two or more identity\nfactors during authentication to prevent unauthorized access.", + "SubSectionObjective": "Ensure that all sensitive activities require two or more identity factors during authentication to prevent unauthorized access.", "Applicability": [ "tlp-clear", "tlp-green", @@ -7279,14 +5313,14 @@ }, { "Id": "CCC.Core.CN03.AR03", - "Description": "When an entity attempts to view information on the service through\na user interface, the authentication process MUST require multiple\nidentifying factors from the user.", + "Description": "When an entity attempts to view information on the service through a user interface, the authentication process MUST require multiple identifying factors from the user.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN03 Implement Multi-factor Authentication (MFA) for Access", "SubSection": "", - "SubSectionObjective": "Ensure that all sensitive activities require two or more identity\nfactors during authentication to prevent unauthorized access.", + "SubSectionObjective": "Ensure that all sensitive activities require two or more identity factors during authentication to prevent unauthorized access.", "Applicability": [ "tlp-amber", "tlp-red" @@ -7346,14 +5380,14 @@ }, { "Id": "CCC.Core.CN03.AR04", - "Description": "When an entity attempts to view information on the service through\nan API endpoint, the authentication process MUST require a\ncredential such as an API key or token AND originate from within\nthe trust perimeter.", + "Description": "When an entity attempts to view information on the service through an API endpoint, the authentication process MUST require a credential such as an API key or token AND originate from within the trust perimeter.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN03 Implement Multi-factor Authentication (MFA) for Access", "SubSection": "", - "SubSectionObjective": "Ensure that all sensitive activities require two or more identity\nfactors during authentication to prevent unauthorized access.", + "SubSectionObjective": "Ensure that all sensitive activities require two or more identity factors during authentication to prevent unauthorized access.", "Applicability": [ "tlp-amber", "tlp-red" @@ -7414,14 +5448,14 @@ }, { "Id": "CCC.Core.CN05.AR01", - "Description": "When an attempt is made to modify data on the service or a child\nresource, the service MUST block requests from unauthorized\nentities.", + "Description": "When an attempt is made to modify data on the service or a child resource, the service MUST block requests from unauthorized entities.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN05 Prevent Access from Untrusted Entities", "SubSection": "", - "SubSectionObjective": "Ensure that secure access controls enforce the principle of least\nprivilege to restrict access to authorized entities from explicitly\ntrusted sources only.", + "SubSectionObjective": "Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.", "Applicability": [ "tlp-clear", "tlp-green", @@ -7496,14 +5530,14 @@ }, { "Id": "CCC.Core.CN05.AR02", - "Description": "When administrative access or configuration change is attempted on\nthe service or a child resource, the service MUST refuse requests\nfrom unauthorized entities.", + "Description": "When administrative access or configuration change is attempted on the service or a child resource, the service MUST refuse requests from unauthorized entities.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN05 Prevent Access from Untrusted Entities", "SubSection": "", - "SubSectionObjective": "Ensure that secure access controls enforce the principle of least\nprivilege to restrict access to authorized entities from explicitly\ntrusted sources only.", + "SubSectionObjective": "Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.", "Applicability": [ "tlp-clear", "tlp-green", @@ -7581,14 +5615,14 @@ }, { "Id": "CCC.Core.CN05.AR03", - "Description": "When administrative access or configuration change is attempted on\nthe service or a child resource in a multi-tenant environment, the\nservice MUST refuse requests across tenant boundaries unless the\norigin is explicitly included in a pre-approved allowlist.", + "Description": "When administrative access or configuration change is attempted on the service or a child resource in a multi-tenant environment, the service MUST refuse requests across tenant boundaries unless the origin is explicitly included in a pre-approved allowlist.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN05 Prevent Access from Untrusted Entities", "SubSection": "", - "SubSectionObjective": "Ensure that secure access controls enforce the principle of least\nprivilege to restrict access to authorized entities from explicitly\ntrusted sources only.", + "SubSectionObjective": "Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.", "Applicability": [ "tlp-clear", "tlp-green", @@ -7648,14 +5682,14 @@ }, { "Id": "CCC.Core.CN05.AR04", - "Description": "When data is requested from outside the trust perimeter, the\nservice MUST refuse requests from unauthorized entities.", + "Description": "When data is requested from outside the trust perimeter, the service MUST refuse requests from unauthorized entities.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "", "SubSection": "CCC.Core.CN05 Prevent Access from Untrusted Entities", - "SubSectionObjective": "Ensure that secure access controls enforce the principle of least\nprivilege to restrict access to authorized entities from explicitly\ntrusted sources only.", + "SubSectionObjective": "Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.", "Applicability": [ "tlp-amber", "tlp-red" @@ -7722,14 +5756,14 @@ }, { "Id": "CCC.Core.CN05.AR05", - "Description": "When any request is made from outside the trust perimeter,\nthe service MUST NOT provide any response that may indicate the\nservice exists.", + "Description": "When any request is made from outside the trust perimeter, the service MUST NOT provide any response that may indicate the service exists.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN05 Prevent Access from Untrusted Entities", "SubSection": "", - "SubSectionObjective": "Ensure that secure access controls enforce the principle of least\nprivilege to restrict access to authorized entities from explicitly\ntrusted sources only.", + "SubSectionObjective": "Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.", "Applicability": [ "tlp-red" ], @@ -7797,14 +5831,14 @@ }, { "Id": "CCC.Core.CN05.AR06", - "Description": "When any request is made to the service or a child resource, the\nservice MUST refuse requests from unauthorized entities.", + "Description": "When any request is made to the service or a child resource, the service MUST refuse requests from unauthorized entities.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN05 Prevent Access from Untrusted Entities", "SubSection": "", - "SubSectionObjective": "Ensure that secure access controls enforce the principle of least\nprivilege to restrict access to authorized entities from explicitly\ntrusted sources only.", + "SubSectionObjective": "Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.", "Applicability": [ "tlp-green", "tlp-amber", @@ -7870,14 +5904,14 @@ }, { "Id": "CCC.Core.CN04.AR01", - "Description": "When administrative access or configuration change is attempted on\nthe service or a child resource, the service MUST log the client\nidentity, time, and result of the attempt.", + "Description": "When administrative access or configuration change is attempted on the service or a child resource, the service MUST log the client identity, time, and result of the attempt.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "The Logging & Monitoring control family ensures that access,\nchanges, and security-relevant events are captured, monitored,\nand alerted on in order to provide visibility, support\nincident response, and meet compliance requirements.\n", + "FamilyDescription": "The Logging & Monitoring control family ensures that access, changes, and security-relevant events are captured, monitored, and alerted on in order to provide visibility, support incident response, and meet compliance requirements. ", "Section": "CCC.Core.CN04 Log All Access and Changes", "SubSection": "", - "SubSectionObjective": "Ensure that all access attempts are logged to maintain a detailed\naudit trail for security and compliance purposes.", + "SubSectionObjective": "Ensure that all access attempts are logged to maintain a detailed audit trail for security and compliance purposes.", "Applicability": [ "tlp-clear", "tlp-green", @@ -7943,14 +5977,14 @@ }, { "Id": "CCC.Core.CN04.AR02", - "Description": "When any attempt is made to modify data on the service or a child\nresource, the service MUST log the client identity, time, and\nresult of the attempt.", + "Description": "When any attempt is made to modify data on the service or a child resource, the service MUST log the client identity, time, and result of the attempt.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "The Logging & Monitoring control family ensures that access,\nchanges, and security-relevant events are captured, monitored,\nand alerted on in order to provide visibility, support\nincident response, and meet compliance requirements.\n", + "FamilyDescription": "The Logging & Monitoring control family ensures that access, changes, and security-relevant events are captured, monitored, and alerted on in order to provide visibility, support incident response, and meet compliance requirements. ", "Section": "CCC.Core.CN04 Log All Access and Changes", "SubSection": "", - "SubSectionObjective": "Ensure that all access attempts are logged to maintain a detailed\naudit trail for security and compliance purposes.", + "SubSectionObjective": "Ensure that all access attempts are logged to maintain a detailed audit trail for security and compliance purposes.", "Applicability": [ "tlp-amber", "tlp-red" @@ -8004,14 +6038,14 @@ }, { "Id": "CCC.Core.CN04.AR03", - "Description": "When any attempt is made to read data on the service or a child\nresource, the service MUST log the client identity, time, and\nresult of the attempt.", + "Description": "When any attempt is made to read data on the service or a child resource, the service MUST log the client identity, time, and result of the attempt.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "The Logging & Monitoring control family ensures that access,\nchanges, and security-relevant events are captured, monitored,\nand alerted on in order to provide visibility, support\nincident response, and meet compliance requirements.\n", + "FamilyDescription": "The Logging & Monitoring control family ensures that access, changes, and security-relevant events are captured, monitored, and alerted on in order to provide visibility, support incident response, and meet compliance requirements. ", "Section": "CCC.Core.CN04 Log All Access and Changes", "SubSection": "", - "SubSectionObjective": "Ensure that all access attempts are logged to maintain a detailed\naudit trail for security and compliance purposes.", + "SubSectionObjective": "Ensure that all access attempts are logged to maintain a detailed audit trail for security and compliance purposes.", "Applicability": [ "tlp-red" ], @@ -8068,19 +6102,19 @@ }, { "Id": "CCC.Core.CN07.AR01", - "Description": "When enumeration activities are detected, the service MUST publish\nan event to a monitored channel which includes the client\nidentity, time, and nature of the activity.", + "Description": "When enumeration activities are detected, the service MUST publish an event to a monitored channel which includes the client identity, time, and nature of the activity.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "The Logging & Monitoring control family ensures that access,\nchanges, and security-relevant events are captured, monitored,\nand alerted on in order to provide visibility, support\nincident response, and meet compliance requirements.\n", + "FamilyDescription": "The Logging & Monitoring control family ensures that access, changes, and security-relevant events are captured, monitored, and alerted on in order to provide visibility, support incident response, and meet compliance requirements. ", "Section": "CCC.Core.CN07 Alert on Unusual Enumeration Activity", "SubSection": "", - "SubSectionObjective": "Ensure that logs and associated alerts are generated when\nunusual enumeration activity is detected that may indicate\nreconnaissance activities.", + "SubSectionObjective": "Ensure that logs and associated alerts are generated when unusual enumeration activity is detected that may indicate reconnaissance activities.", "Applicability": [ "tlp-amber", "tlp-red" ], - "Recommendation": "Implement event publication mechanisms and alerts for patterns\nindicative of enumeration activities, such as repeated access\nattempts, requests, or liveness probes. Configure alerts to notify\nsecurity teams of any activities that merit further investigation.\n", + "Recommendation": "Implement event publication mechanisms and alerts for patterns indicative of enumeration activities, such as repeated access attempts, requests, or liveness probes. Configure alerts to notify security teams of any activities that merit further investigation. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -8118,21 +6152,21 @@ }, { "Id": "CCC.Core.CN07.AR02", - "Description": "When enumeration activities are detected, the service MUST log the\nclient identity, time, and nature of the activity.", + "Description": "When enumeration activities are detected, the service MUST log the client identity, time, and nature of the activity.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "The Logging & Monitoring control family ensures that access,\nchanges, and security-relevant events are captured, monitored,\nand alerted on in order to provide visibility, support\nincident response, and meet compliance requirements.\n", + "FamilyDescription": "The Logging & Monitoring control family ensures that access, changes, and security-relevant events are captured, monitored, and alerted on in order to provide visibility, support incident response, and meet compliance requirements. ", "Section": "CCC.Core.CN07 Alert on Unusual Enumeration Activity", "SubSection": "", - "SubSectionObjective": "Ensure that logs and associated alerts are generated when\nunusual enumeration activity is detected that may indicate\nreconnaissance activities.", + "SubSectionObjective": "Ensure that logs and associated alerts are generated when unusual enumeration activity is detected that may indicate reconnaissance activities.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Implement logging mechanisms to capture details of enumeration\nactivities, including client identity, timestamps, and activity\nnature. Retain logs according to organizational policies, and\noccasionally review them for patterns that may indicate\nreconnaissance activities.\n", + "Recommendation": "Implement logging mechanisms to capture details of enumeration activities, including client identity, timestamps, and activity nature. Retain logs according to organizational policies, and occasionally review them for patterns that may indicate reconnaissance activities. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", diff --git a/prowler/compliance/azure/ccc_azure.json b/prowler/compliance/azure/ccc_azure.json index efc2188406..004137ad53 100644 --- a/prowler/compliance/azure/ccc_azure.json +++ b/prowler/compliance/azure/ccc_azure.json @@ -6,19 +6,19 @@ "Description": "Common Cloud Controls Catalog (CCC) for Azure", "Requirements": [ { - "Id": "CCC.AuditLog.C01.TR01", + "Id": "CCC.AuditLog.CN01.AR01", "Description": "When the signature validation process is performed, then it MUST detect any modification of data.", "Attributes": [ { "FamilyName": "Integrity", "FamilyDescription": "Controls designed to protected the integrity of Audit Log data.", - "Section": "CCC.AuditLog.C01 Implement Digital Signatures With Hash Chaining", + "Section": "CCC.AuditLog.CN01 Implement Digital Signatures With Hash Chaining", "SubSection": "", - "SubSectionObjective": "Digital signatures allows for external verification of log data tampering and\nhash chaining allows for deleted log files to be detected.", + "SubSectionObjective": "Digital signatures allows for external verification of log data tampering and hash chaining allows for deleted log files to be detected.", "Applicability": [ "tlp-red" ], - "Recommendation": "Ensure hash of data is included in digital signature.\n", + "Recommendation": "Ensure hash of data is included in digital signature. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -47,19 +47,19 @@ "Checks": [] }, { - "Id": "CCC.AuditLog.C01.TR02", + "Id": "CCC.AuditLog.CN01.AR02", "Description": "When the signature validation process is performed, then it MUST detect any missing (deleted) log file.", "Attributes": [ { "FamilyName": "Integrity", "FamilyDescription": "Controls designed to protected the integrity of Audit Log data.", - "Section": "CCC.AuditLog.C01 Implement Digital Signatures With Hash Chaining", + "Section": "CCC.AuditLog.CN01 Implement Digital Signatures With Hash Chaining", "SubSection": "", - "SubSectionObjective": "Digital signatures allows for external verification of log data tampering and\nhash chaining allows for deleted log files to be detected.", + "SubSectionObjective": "Digital signatures allows for external verification of log data tampering and hash chaining allows for deleted log files to be detected.", "Applicability": [ "tlp-red" ], - "Recommendation": "Ensure verification process includes a chained hash function.\n", + "Recommendation": "Ensure verification process includes a chained hash function. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -88,15 +88,15 @@ "Checks": [] }, { - "Id": "CCC.AuditLog.C02.TR01", - "Description": "When a manual action is performed to generate each audit log type,\nthen the corresponding audit log type MUST be generated and recorded.", + "Id": "CCC.AuditLog.CN02.AR01", + "Description": "When a manual action is performed to generate each audit log type, then the corresponding audit log type MUST be generated and recorded.", "Attributes": [ { "FamilyName": "Integrity", "FamilyDescription": "Controls designed to protected the integrity of Audit Log data.", - "Section": "CCC.AuditLog.C02 Enable And Validate All Audit Log Types", + "Section": "CCC.AuditLog.CN02 Enable And Validate All Audit Log Types", "SubSection": "", - "SubSectionObjective": "Review audit log configuration and ensure that all audit log types\nare being generated and replicated to configured sinks", + "SubSectionObjective": "Review audit log configuration and ensure that all audit log types are being generated and replicated to configured sinks", "Applicability": [ "tlp-red", "tlp-amber" @@ -136,20 +136,20 @@ ] }, { - "Id": "CCC.AuditLog.C03.TR01", + "Id": "CCC.AuditLog.CN03.AR01", "Description": "When an attempt is made to disable a log source, then an alert MUST be generated.", "Attributes": [ { "FamilyName": "Integrity", "FamilyDescription": "Controls designed to protected the integrity of Audit Log data.", - "Section": "CCC.AuditLog.C03 Alert On Audit Log Changes And Access", + "Section": "CCC.AuditLog.CN03 Alert On Audit Log Changes And Access", "SubSection": "", - "SubSectionObjective": "Ensure that specific alerts have been configured to detect changes in\naudit log configuration such as disabling exporting of logs.\nAlerts MUST also be created to detect changes in retention/object lock policies\nfor exported data log sources/buckets.", + "SubSectionObjective": "Ensure that specific alerts have been configured to detect changes in audit log configuration such as disabling exporting of logs. Alerts MUST also be created to detect changes in retention/object lock policies for exported data log sources/buckets.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Ensure alerting is correctly configured\n", + "Recommendation": "Ensure alerting is correctly configured ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -183,20 +183,20 @@ ] }, { - "Id": "CCC.AuditLog.C03.TR02", - "Description": "When an attempt is made to alter the retention or object lock status\nof an external data log source or bucket, then an alert MUST be generated.", + "Id": "CCC.AuditLog.CN03.AR02", + "Description": "When an attempt is made to alter the retention or object lock status of an external data log source or bucket, then an alert MUST be generated.", "Attributes": [ { "FamilyName": "Integrity", "FamilyDescription": "Controls designed to protected the integrity of Audit Log data.", - "Section": "CCC.AuditLog.C03 Alert On Audit Log Changes And Access", + "Section": "CCC.AuditLog.CN03 Alert On Audit Log Changes And Access", "SubSection": "", - "SubSectionObjective": "Ensure that specific alerts have been configured to detect changes in\naudit log configuration such as disabling exporting of logs.\nAlerts MUST also be created to detect changes in retention/object lock policies\nfor exported data log sources/buckets.", + "SubSectionObjective": "Ensure that specific alerts have been configured to detect changes in audit log configuration such as disabling exporting of logs. Alerts MUST also be created to detect changes in retention/object lock policies for exported data log sources/buckets.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Ensure alerting is correctly configured\n", + "Recommendation": "Ensure alerting is correctly configured ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -240,20 +240,20 @@ ] }, { - "Id": "CCC.AuditLog.C04.TR01", - "Description": "When audit log buckets are created then verify that server access\nlogging MUST be enabled for the audit log bucket,\nwith logs delivered to a separate, secure logging bucket.", + "Id": "CCC.AuditLog.CN04.AR01", + "Description": "When audit log buckets are created then verify that server access logging MUST be enabled for the audit log bucket, with logs delivered to a separate, secure logging bucket.", "Attributes": [ { "FamilyName": "Integrity", "FamilyDescription": "Controls designed to protected the integrity of Audit Log data.", - "Section": "CCC.AuditLog.C04 Ensure Access Logging Is Enabled on the Audit Log Bucket", + "Section": "CCC.AuditLog.CN04 Ensure Access Logging Is Enabled on the Audit Log Bucket", "SubSection": "", - "SubSectionObjective": "Ensure that access logging is enabled for the audit log storage bucket to\ncapture all requests made to the bucket, providing an audit trail of data access.", + "SubSectionObjective": "Ensure that access logging is enabled for the audit log storage bucket to capture all requests made to the bucket, providing an audit trail of data access.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Configure the audit log bucket to enable server access logging.\nEnsure the target logging bucket is configured for appropriate security,\nincluding restricted access and immutability.\n", + "Recommendation": "Configure the audit log bucket to enable server access logging. Ensure the target logging bucket is configured for appropriate security, including restricted access and immutability. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -289,20 +289,20 @@ ] }, { - "Id": "CCC.AuditLog.C05.TR01", + "Id": "CCC.AuditLog.CN05.AR01", "Description": "When audit logs are exported, then audit logs MUST be present in the configured data location.", "Attributes": [ { "FamilyName": "Availability", "FamilyDescription": "Controls designed to protected the availability of Audit Log data.", - "Section": "CCC.AuditLog.C05 Export Audit Logs To Bucket", + "Section": "CCC.AuditLog.CN05 Export Audit Logs To Bucket", "SubSection": "", - "SubSectionObjective": "Configure audit logs to be sent to a external bucket where they can be globally replicated\nand can be subject to greater access control and data retention polices.", + "SubSectionObjective": "Configure audit logs to be sent to a external bucket where they can be globally replicated and can be subject to greater access control and data retention polices.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Configure audit log exporting.\n", + "Recommendation": "Configure audit log exporting. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -337,21 +337,21 @@ ] }, { - "Id": "CCC.AuditLog.C06.TR01", - "Description": "When the retention policy is applied, then data MUST\nbe automatically deleted after the configured number of days.", + "Id": "CCC.AuditLog.CN06.AR01", + "Description": "When the retention policy is applied, then data MUST be automatically deleted after the configured number of days.", "Attributes": [ { "FamilyName": "Availability", "FamilyDescription": "Controls designed to protected the availability of Audit Log data.", - "Section": "CCC.AuditLog.C06 Enforce Retention Policy on Audit Log Bucket", + "Section": "CCC.AuditLog.CN06 Enforce Retention Policy on Audit Log Bucket", "SubSection": "", - "SubSectionObjective": "Configure a custom retention policy on the designated audit log bucket to ensure that logs are\nretained for the correct number of days as defined by your organization's policy.", + "SubSectionObjective": "Configure a custom retention policy on the designated audit log bucket to ensure that logs are retained for the correct number of days as defined by your organization's policy.", "Applicability": [ "tlp-red", "tlp-amber", "tlp-green" ], - "Recommendation": "Configure the audit log bucket's lifecycle rules or object retention settings to enforce\nthe required data retention period.\n", + "Recommendation": "Configure the audit log bucket's lifecycle rules or object retention settings to enforce the required data retention period. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -384,21 +384,21 @@ ] }, { - "Id": "CCC.AuditLog.C07.TR01", - "Description": "When a standard file deletion is attempted on an object within\nthe audit log bucket, then it MUST be prevented unless MFA is provided.", + "Id": "CCC.AuditLog.CN07.AR01", + "Description": "When a standard file deletion is attempted on an object within the audit log bucket, then it MUST be prevented unless MFA is provided.", "Attributes": [ { "FamilyName": "Availability", "FamilyDescription": "Controls designed to protected the availability of Audit Log data.", - "Section": "CCC.AuditLog.C07 Enforce MFA Delete on Audit Log Bucket", + "Section": "CCC.AuditLog.CN07 Enforce MFA Delete on Audit Log Bucket", "SubSection": "", - "SubSectionObjective": "Enable Multi-Factor Authentication (MFA) delete on the audit log bucket to\nprovide greater protection against accidental or malicious deletion of audit data.", + "SubSectionObjective": "Enable Multi-Factor Authentication (MFA) delete on the audit log bucket to provide greater protection against accidental or malicious deletion of audit data.", "Applicability": [ "tlp-red", "tlp-amber", "tlp-green" ], - "Recommendation": "Enable MFA Delete (or equivalent multi-factor authentication for delete operations)\non the audit log bucket.\n", + "Recommendation": "Enable MFA Delete (or equivalent multi-factor authentication for delete operations) on the audit log bucket. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -428,20 +428,20 @@ "Checks": [] }, { - "Id": "CCC.AuditLog.C08.TR01", - "Description": "When an attempt is made to delete data before the object\nlock period expires, then the deletion MUST be denied.", + "Id": "CCC.AuditLog.CN08.AR01", + "Description": "When an attempt is made to delete data before the object lock period expires, then the deletion MUST be denied.", "Attributes": [ { "FamilyName": "Availability", "FamilyDescription": "Controls designed to protected the availability of Audit Log data.", - "Section": "CCC.AuditLog.C08 Enable Object Lock On Audit Log Bucket", + "Section": "CCC.AuditLog.CN08 Enable Object Lock On Audit Log Bucket", "SubSection": "", - "SubSectionObjective": "Ensure that object log is enabled globally on all objects with the bucket.\nThe lock time MUST be configured to meet your organization, legal and compliance goals.\nDeletion attempts before the lock period MUST be denied.", + "SubSectionObjective": "Ensure that object log is enabled globally on all objects with the bucket. The lock time MUST be configured to meet your organization, legal and compliance goals. Deletion attempts before the lock period MUST be denied.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Configure object lock policy.\n", + "Recommendation": "Configure object lock policy. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -475,20 +475,20 @@ ] }, { - "Id": "CCC.AuditLog.C09.TR01", + "Id": "CCC.AuditLog.CN09.AR01", "Description": "When restricted fields are accessed by unauthorized users, then those fields MUST remain masked.", "Attributes": [ { "FamilyName": "Confidentiality", "FamilyDescription": "Controls designed to protected the confidentiality of Audit Log data.", - "Section": "CCC.AuditLog.C09 Restrict Field And Log Type Access", + "Section": "CCC.AuditLog.CN09 Restrict Field And Log Type Access", "SubSection": "", - "SubSectionObjective": "Configure access to audit logs to follow the principle of least privilege in particular where technically\npossible limit the log fields users have access to to prevent accidental exposure to sensitive\ninformation such as PII.", + "SubSectionObjective": "Configure access to audit logs to follow the principle of least privilege in particular where technically possible limit the log fields users have access to to prevent accidental exposure to sensitive information such as PII.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Review field level access controls on audit data.\n", + "Recommendation": "Review field level access controls on audit data. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -525,21 +525,21 @@ ] }, { - "Id": "CCC.AuditLog.C10.TR01", - "Description": "When audit log storage bucket's are created then, bucket's access control settings MUST explicitly deny\npublic read and write access.", + "Id": "CCC.AuditLog.CN10.AR01", + "Description": "When audit log storage bucket's are created then, bucket's access control settings MUST explicitly deny public read and write access.", "Attributes": [ { "FamilyName": "Confidentiality", "FamilyDescription": "Controls designed to protected the confidentiality of Audit Log data.", - "Section": "CCC.AuditLog.C10 Ensure Audit Bucket is Not Publicly Accessible", + "Section": "CCC.AuditLog.CN10 Ensure Audit Bucket is Not Publicly Accessible", "SubSection": "", - "SubSectionObjective": "Ensure that audit log storage buckets are not publicly accessible to prevent\nunauthorized exposure of sensitive log data.", + "SubSectionObjective": "Ensure that audit log storage buckets are not publicly accessible to prevent unauthorized exposure of sensitive log data.", "Applicability": [ "tlp-red", "tlp-amber", "tlp-green" ], - "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access.\nRegularly review bucket permissions to ensure no public access has been inadvertently granted.\n", + "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access. Regularly review bucket permissions to ensure no public access has been inadvertently granted. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -573,21 +573,21 @@ ] }, { - "Id": "CCC.AuditLog.C10.TR02", - "Description": "When the URL of a audit log storage bucket's object is accessed publicly then,\nit should be denied by bucket policy.", + "Id": "CCC.AuditLog.CN10.AR02", + "Description": "When the URL of a audit log storage bucket's object is accessed publicly then, it should be denied by bucket policy.", "Attributes": [ { "FamilyName": "Confidentiality", "FamilyDescription": "Controls designed to protected the confidentiality of Audit Log data.", - "Section": "CCC.AuditLog.C10 Ensure Audit Bucket is Not Publicly Accessible", + "Section": "CCC.AuditLog.CN10 Ensure Audit Bucket is Not Publicly Accessible", "SubSection": "", - "SubSectionObjective": "Ensure that audit log storage buckets are not publicly accessible to prevent\nunauthorized exposure of sensitive log data.", + "SubSectionObjective": "Ensure that audit log storage buckets are not publicly accessible to prevent unauthorized exposure of sensitive log data.", "Applicability": [ "tlp-red", "tlp-amber", "tlp-green" ], - "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access.\nRegularly review bucket permissions to ensure no public access has been inadvertently granted.\n", + "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access. Regularly review bucket permissions to ensure no public access has been inadvertently granted. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -622,15 +622,15 @@ ] }, { - "Id": "CCC.Build.C01.TR01", + "Id": "CCC.Build.CN01.AR01", "Description": "Attempt to initiate a build using an unauthorized build agent and verify that the build is rejected.", "Attributes": [ { "FamilyName": "Access Control", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.Build.C01 Restrict Allowed Build Agents", + "Section": "CCC.Build.CN01 Restrict Allowed Build Agents", "SubSection": "", - "SubSectionObjective": "Ensure that builds are executed only on authorized build agents to maintain\ncontrol over the build environment and prevent unauthorized code execution.", + "SubSectionObjective": "Ensure that builds are executed only on authorized build agents to maintain control over the build environment and prevent unauthorized code execution.", "Applicability": [ "tlp-red", "tlp-amber" @@ -664,15 +664,15 @@ "Checks": [] }, { - "Id": "CCC.Build.C02.TR01", - "Description": "Attempt to trigger a build from an unauthorized external service or\nrepository and verify that the build does not start.", + "Id": "CCC.Build.CN02.AR01", + "Description": "Attempt to trigger a build from an unauthorized external service or repository and verify that the build does not start.", "Attributes": [ { "FamilyName": "Access Control", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.Build.C02 Restrict Allowed External Services for Build Triggers", + "Section": "CCC.Build.CN02 Restrict Allowed External Services for Build Triggers", "SubSection": "", - "SubSectionObjective": "Ensure that builds can only be triggered by authorized external services or\nrepositories to prevent unauthorized code execution or tampering.", + "SubSectionObjective": "Ensure that builds can only be triggered by authorized external services or repositories to prevent unauthorized code execution or tampering.", "Applicability": [ "tlp-red", "tlp-amber" @@ -706,15 +706,15 @@ "Checks": [] }, { - "Id": "CCC.Build.C03.TR01", + "Id": "CCC.Build.CN03.AR01", "Description": "Attempt to access the build environment from an external network and verify that access is denied.", "Attributes": [ { "FamilyName": "Network Security", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.Build.C03 Deny External Network Access for Build Environments", + "Section": "CCC.Build.CN03 Deny External Network Access for Build Environments", "SubSection": "", - "SubSectionObjective": "Ensure that build environments do not have external network access to\nprevent unauthorized external access and data exfiltration.", + "SubSectionObjective": "Ensure that build environments do not have external network access to prevent unauthorized external access and data exfiltration.", "Applicability": [ "tlp-red", "tlp-amber" @@ -758,15 +758,15 @@ ] }, { - "Id": "CCC.CntrReg.C01.TR01", - "Description": "Attempt to push an artifact with known vulnerabilities to the registry\nand observe if it is flagged or rejected by the vulnerability scanning process.", + "Id": "CCC.CntrReg.CN01.AR01", + "Description": "Attempt to push an artifact with known vulnerabilities to the registry and observe if it is flagged or rejected by the vulnerability scanning process.", "Attributes": [ { "FamilyName": "Risk Management", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.CntrReg.C01 Implement Vulnerability Scanning for Artifacts", + "Section": "CCC.CntrReg.CN01 Implement Vulnerability Scanning for Artifacts", "SubSection": "", - "SubSectionObjective": "Ensure that container images and artifacts stored in the container registry are scanned for\nvulnerabilities to identify and remediate security issues before deployment.", + "SubSectionObjective": "Ensure that container images and artifacts stored in the container registry are scanned for vulnerabilities to identify and remediate security issues before deployment.", "Applicability": [ "tlp-red", "tlp-amber" @@ -803,60 +803,15 @@ ] }, { - "Id": "CCC.CntrReg.C02.TR01", - "Description": "Confirm that artifacts older than the specified retention period are automatically\ndeleted from the registry.", - "Attributes": [ - { - "FamilyName": "Data Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.CntrReg.C02 Implement Cleanup Policies for Artifacts", - "SubSection": "", - "SubSectionObjective": "Ensure that unused or outdated artifacts are cleaned up according to defined policies to\nmanage storage effectively and reduce security risks associated with outdated versions.", - "Applicability": [ - "tlp-red", - "tlp-amber" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.TH14" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.IP-6" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SI-12" - ] - } - ] - } - ], - "Checks": [ - "containerregistry_not_publicly_accessible", - "containerregistry_uses_private_link", - "containerregistry_admin_user_disabled" - ] - }, - { - "Id": "CCC.DataWar.C01.TR01", - "Description": "Attempt to access underlying database tables directly without\nusing managed views and verify that access is denied.", + "Id": "CCC.DataWar.CN01.AR01", + "Description": "Attempt to access underlying database tables directly without using managed views and verify that access is denied.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.DataWar.C01 Enforce Use of Managed Views for Data Access", + "Section": "CCC.DataWar.CN01 Enforce Use of Managed Views for Data Access", "SubSection": "", - "SubSectionObjective": "Ensure that data access is provided through managed views, restricting users\nfrom accessing underlying tables directly and enforcing consistent security policies.", + "SubSectionObjective": "Ensure that data access is provided through managed views, restricting users from accessing underlying tables directly and enforcing consistent security policies.", "Applicability": [ "tlp-red", "tlp-amber" @@ -890,15 +845,15 @@ "Checks": [] }, { - "Id": "CCC.DataWar.C02.TR01", - "Description": "Attempt to query sensitive columns without the necessary permissions and\nverify that access is denied or data is masked.", + "Id": "CCC.DataWar.CN02.AR01", + "Description": "Attempt to query sensitive columns without the necessary permissions and verify that access is denied or data is masked.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.DataWar.C02 Enforce Column-Level Security Policies", + "Section": "CCC.DataWar.CN02 Enforce Column-Level Security Policies", "SubSection": "", - "SubSectionObjective": "Ensure that access to sensitive data columns is restricted based on user roles,\npreventing unauthorized access to sensitive information.", + "SubSectionObjective": "Ensure that access to sensitive data columns is restricted based on user roles, preventing unauthorized access to sensitive information.", "Applicability": [ "tlp-red", "tlp-amber" @@ -932,15 +887,15 @@ "Checks": [] }, { - "Id": "CCC.DataWar.C03.TR01", - "Description": "Attempt to query data rows that the user should not have access to and verify\nthat access is denied or data is not returned.", + "Id": "CCC.DataWar.CN03.AR01", + "Description": "Attempt to query data rows that the user should not have access to and verify that access is denied or data is not returned.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.DataWar.C03 Enforce Row-Level Security Policies", + "Section": "CCC.DataWar.CN03 Enforce Row-Level Security Policies", "SubSection": "", - "SubSectionObjective": "Ensure that access to data rows is restricted based on user roles or attributes,\npreventing unauthorized access to specific subsets of data.", + "SubSectionObjective": "Ensure that access to data rows is restricted based on user roles or attributes, preventing unauthorized access to specific subsets of data.", "Applicability": [ "tlp-red", "tlp-amber" @@ -980,684 +935,13 @@ ] }, { - "Id": "CCC.GenAI.C01.TR01", - "Description": "Untrusted input such as user queries, RAG data or tool output\nMUST be validated before it is passed to a GenAI model.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C01 Model Input Filtering and Sanitisation", - "SubSection": "", - "SubSectionObjective": "Inspect and validate input before it is passed to a GenAI\nmodel in order to filter or sanitise adversarial queries\nand prevent sensitive data leakage.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH01", - "CCC.GenAI.TH03" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-003", - "AIR-PREV-017", - "AIR-PREV-002", - "AIR-DET-001" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Input Validation and Sanitization" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0020", - "AML.M0021", - "AML.M0015" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.GenAI.C01.TR02", - "Description": "If malicious patterns such as prompt injection or sensitive\ndata are detected during input validation, the input MUST\nbe blocked or sanitised.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C01 Model Input Filtering and Sanitisation", - "SubSection": "", - "SubSectionObjective": "Inspect and validate input before it is passed to a GenAI\nmodel in order to filter or sanitise adversarial queries\nand prevent sensitive data leakage.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH01", - "CCC.GenAI.TH03" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-003", - "AIR-PREV-017", - "AIR-PREV-002", - "AIR-DET-001" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Input Validation and Sanitization" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0020", - "AML.M0021", - "AML.M0015" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.GenAI.C02.TR01", - "Description": "GenAI model output MUST be validated for format conformance,\nmalicious patterns, sensitive data and inapropriate content\nbefore being passed to users, application or plugins.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C02 Model Output Filtering and Sanitisation", - "SubSection": "", - "SubSectionObjective": "Inspect and validate GenAI model output before passing it to\nusers, applications or plugins in order to filter or sanitise\ninsecure or unreliable output and prevent sensitive data leakage.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH01", - "CCC.GenAI.TH03", - "CCC.GenAI.TH04", - "CCC.GenAI.TH05", - "CCC.GenAI.TH06" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-003", - "AIR-PREV-017", - "AIR-PREV-002", - "AIR-DET-001" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Output Validation and Sanitization" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0020", - "AML.M0002" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.GenAI.C02.TR02", - "Description": "In the event of policy violations, the AI-generated content MUST\nbe redacted, encoded or rejected.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C02 Model Output Filtering and Sanitisation", - "SubSection": "", - "SubSectionObjective": "Inspect and validate GenAI model output before passing it to\nusers, applications or plugins in order to filter or sanitise\ninsecure or unreliable output and prevent sensitive data leakage.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH01", - "CCC.GenAI.TH03", - "CCC.GenAI.TH04", - "CCC.GenAI.TH05", - "CCC.GenAI.TH06" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-003", - "AIR-PREV-017", - "AIR-PREV-002", - "AIR-DET-001" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Output Validation and Sanitization" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0020", - "AML.M0002" - ] - } - ] - } - ], - "Checks": [ - "apim_threat_detection_llm_jacking" - ] - }, - { - "Id": "CCC.GenAI.C03.TR01", - "Description": "When data is designated for model training or RAG ingestion, then its\nsource MUST be explicitly approved and its provenance documented.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C03 Data Provenance and Source Vetting", - "SubSection": "", - "SubSectionObjective": "Ensure that all data for training, fine-tuning or RAG comes\nfrom trusted, approved sources and is authorised for the\nintended purposes in order to prevent the initial introduction\nof malicious content or leaked sensitive data.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH02", - "CCC.GenAI.TH03" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-006" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Training Data Management" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0025" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.GenAI.C03.TR02", - "Description": "Data from unvetted sources MUST NOT be used in production systems.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C03 Data Provenance and Source Vetting", - "SubSection": "", - "SubSectionObjective": "Ensure that all data for training, fine-tuning or RAG comes\nfrom trusted, approved sources and is authorised for the\nintended purposes in order to prevent the initial introduction\nof malicious content or leaked sensitive data.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH02", - "CCC.GenAI.TH03" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-006" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Training Data Management" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0025" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.GenAI.C04.TR01", - "Description": "When data is ingested for training, fine-tuning or conversion\nto vector embeddings, it MUST be validated for sensitive\ninformation or malicious content.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C04 Sanitisation of Ingested Data", - "SubSection": "", - "SubSectionObjective": "Validate and sanitise all data ingested by GenAI systems\nfrom extenal sources or internal knowledge bases, whether\nfor training, conversion to vector embeddings, or real-time\nretireval, in order to remove or redact poisoned or sensitive\ndata before further processing.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH02", - "CCC.GenAI.TH03" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-002" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Training Data Sanitization" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0007" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.GenAI.C04.TR02", - "Description": "If sensitive data or malicious content is detected, it must\nbe rejected, redacted or flagged for manual review.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C04 Sanitisation of Ingested Data", - "SubSection": "", - "SubSectionObjective": "Validate and sanitise all data ingested by GenAI systems\nfrom extenal sources or internal knowledge bases, whether\nfor training, conversion to vector embeddings, or real-time\nretireval, in order to remove or redact poisoned or sensitive\ndata before further processing.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH02", - "CCC.GenAI.TH03" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-002" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Training Data Sanitization" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0007" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.GenAI.C05.TR01", - "Description": "When a RAG-enabled system generates a response containing information\nretrieved from its knowledge base, then the response MUST include a\nverifiable citation that links back to the specific source document.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C05 Citations and Source Traceability", - "SubSection": "", - "SubSectionObjective": "Require the GenAI system to provide citations or direct links\nback to the source documents used to generate a response, in\nto enhance the transparency, trustworthiness, and verifiability\nof AI-generated content.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH09", - "CCC.GenAI.TH04" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-DET-013" - ] - } - ] - } - ], - "Checks": [ - "monitor_diagnostic_settings_exists", - "monitor_diagnostic_setting_with_appropriate_categories", - "keyvault_logging_enabled", - "app_http_logs_enabled", - "app_function_application_insights_enabled", - "appinsights_ensure_is_configured", - "monitor_alert_service_health_exists", - "sqlserver_auditing_enabled", - "sqlserver_auditing_retention_90_days", - "mysql_flexible_server_audit_log_enabled" - ] - }, - { - "Id": "CCC.GenAI.C06.TR01", - "Description": "When an LLM invokes an external tool (e.g., an API, a plugin),\nthen the tool MUST operate with the least privileges required\nfor performing its intended functionality.", - "Attributes": [ - { - "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", - "Section": "CCC.GenAI.C06 Least Privilege for Plugins", - "SubSection": "", - "SubSectionObjective": "Restricts the permissions of any external tools the GenAI system\ncan call to limit the potential damage if an agent is coerced\nto perform unintended actions or vulnerabilities in the tools\nare exploited.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH07", - "CCC.GenAI.TH06" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Agent Permissions" - ] - } - ] - } - ], - "Checks": [ - "iam_custom_role_has_permissions_to_administer_resource_locks", - "iam_subscription_roles_owner_custom_not_created", - "iam_role_user_access_admin_restricted", - "app_function_identity_without_admin_privileges", - "app_function_identity_is_configured", - "cosmosdb_account_use_aad_and_rbac" - ] - }, - { - "Id": "CCC.GenAI.C07.TR01", - "Description": "When an application makes an API call to a foundational model in a\nproduction environment, then it MUST specify an explicit version\nidentifier.", - "Attributes": [ - { - "FamilyName": "Configuration Management", - "FamilyDescription": "The Configuration Management control family involves establishing,\nmaintaining and monitoring the configuration of the service and\nrelated applications and infrastructure to ensure consistency,\nsecure defaults and compliance.\n", - "Section": "CCC.GenAI.C07 Model Version Pinning", - "SubSection": "", - "SubSectionObjective": "Mandate that applications are locked (\"pinned\") to a specific,\ntested version of a foundational model to prevent unexpected\nbehaviour changes introduced by provider-side updates.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH10" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-010" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.GenAI.C08.TR01", - "Description": "When a new AI model is considered for production deployment, it\nMUST undergo a formal red teaming and quality assurance review.", - "Attributes": [ - { - "FamilyName": "Model Assurance and Evaluation", - "FamilyDescription": "The Model Assurance and Evaluation control family encompasses\nthe proactiveand continuous processes of testing and validating\nthe AI model's behavior to ensure it aligns with safety, ethical,\nand quality standards.\n", - "Section": "CCC.GenAI.C08 Quality Control and Red Teaming", - "SubSection": "", - "SubSectionObjective": "Establish a formal program for quality evaluation and adversarial\ntesting (red teaming) to ensure GenAI system meet all business,\nquality, security and compliance requirements before getting deployed\ninto production environments.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH01", - "CCC.GenAI.TH02", - "CCC.GenAI.TH04", - "CCC.GenAI.TH08", - "CCC.GenAI.TH10" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-005" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Adversarial Training and Testing", - "Red Teaming", - "Product Governance" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0008" - ] - } - ] - } - ], - "Checks": [ - "apim_threat_detection_llm_jacking" - ] - }, - { - "Id": "CCC.GenAI.C08.TR02", - "Description": "If model quality review or red teaming identifies an issue that exceeds\nthe organization's risk tolerance, the model MUST NOT be deployed until\nthe issue is remediated.", - "Attributes": [ - { - "FamilyName": "Model Assurance and Evaluation", - "FamilyDescription": "The Model Assurance and Evaluation control family encompasses\nthe proactiveand continuous processes of testing and validating\nthe AI model's behavior to ensure it aligns with safety, ethical,\nand quality standards.\n", - "Section": "CCC.GenAI.C08 Quality Control and Red Teaming", - "SubSection": "", - "SubSectionObjective": "Establish a formal program for quality evaluation and adversarial\ntesting (red teaming) to ensure GenAI system meet all business,\nquality, security and compliance requirements before getting deployed\ninto production environments.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH01", - "CCC.GenAI.TH02", - "CCC.GenAI.TH04", - "CCC.GenAI.TH08", - "CCC.GenAI.TH10" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-005" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Adversarial Training and Testing", - "Red Teaming", - "Product Governance" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0008" - ] - } - ] - } - ], - "Checks": [ - "apim_threat_detection_llm_jacking" - ] - }, - { - "Id": "CCC.KeyMgmt.C01.TR01", - "Description": "When a key version is scheduled for deletion or disabled, an\nalert MUST be generated within five minutes.", + "Id": "CCC.KeyMgmt.CN01.AR01", + "Description": "When a key version is scheduled for deletion or disabled, an alert MUST be generated within five minutes.", "Attributes": [ { "FamilyName": "Logging and Metrics Publication", "FamilyDescription": "Controls that collect, alert, and retain key-management events.", - "Section": "CCC.KeyMgmt.C01 Alert on Key-version Changes", + "Section": "CCC.KeyMgmt.CN01 Alert on Key-version Changes", "SubSection": "", "SubSectionObjective": "Generate near-real-time alerts when a KMS key version is disabled or scheduled for deletion, enabling rapid investigation and recovery.", "Applicability": [ @@ -1700,13 +984,13 @@ ] }, { - "Id": "CCC.KeyMgmt.C02.TR01", - "Description": "When IAM roles and key policies are reviewed, Decrypt permission\nMUST be granted exclusively to documented authorised principals.", + "Id": "CCC.KeyMgmt.CN02.AR01", + "Description": "When IAM roles and key policies are reviewed, Decrypt permission MUST be granted exclusively to documented authorised principals.", "Attributes": [ { "FamilyName": "Identity and Access Management", "FamilyDescription": "Controls that enforce least-privilege use of KMS operations.", - "Section": "CCC.KeyMgmt.C02 Limit Decrypt Permissions", + "Section": "CCC.KeyMgmt.CN02 Limit Decrypt Permissions", "SubSection": "", "SubSectionObjective": "Restrict the Decrypt operation to authorised principals only, applying the principle of least privilege to protect sensitive data.", "Applicability": [ @@ -1745,13 +1029,13 @@ ] }, { - "Id": "CCC.KeyMgmt.C03.TR01", - "Description": "When rotation settings are examined, rotation MUST be enabled with\nan interval not exceeding 365 days.", + "Id": "CCC.KeyMgmt.CN03.AR01", + "Description": "When rotation settings are examined, rotation MUST be enabled with an interval not exceeding 365 days.", "Attributes": [ { "FamilyName": "Key Lifecycle Management", "FamilyDescription": "Controls that govern creation, rotation, import, and retirement of cryptographic keys.", - "Section": "CCC.KeyMgmt.C03 Enforce Automatic Rotation", + "Section": "CCC.KeyMgmt.CN03 Enforce Automatic Rotation", "SubSection": "", "SubSectionObjective": "Ensure symmetric keys rotate automatically within policy intervals to reduce exposure of key material.", "Applicability": [ @@ -1787,13 +1071,13 @@ ] }, { - "Id": "CCC.KeyMgmt.C04.TR01", - "Description": "When a key import request is processed, the key MUST use an\napproved algorithm (RSA-2048+, EC-P256+) and originate from a\ncertified HSM.", + "Id": "CCC.KeyMgmt.CN04.AR01", + "Description": "When a key import request is processed, the key MUST use an approved algorithm (RSA-2048+, EC-P256+) and originate from a certified HSM.", "Attributes": [ { "FamilyName": "Key Lifecycle Management", "FamilyDescription": "Controls that govern creation, rotation, import, and retirement of cryptographic keys.", - "Section": "CCC.KeyMgmt.C04 Validate Imported Keys", + "Section": "CCC.KeyMgmt.CN04 Validate Imported Keys", "SubSection": "", "SubSectionObjective": "Accept only externally generated keys that meet approved cryptographic strength and provenance requirements.", "Applicability": [ @@ -1838,13 +1122,13 @@ ] }, { - "Id": "CCC.LB.C01.TR01", - "Description": "When a single client sends more than 2000 requests within any\n5-minute sliding window, the load balancer MUST throttle all\nsubsequent requests from that client for at least 60 seconds.", + "Id": "CCC.LB.CN01.AR01", + "Description": "When a single client sends more than 2000 requests within any 5-minute sliding window, the load balancer MUST throttle all subsequent requests from that client for at least 60 seconds.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "Controls that detect anomalous traffic and record load-balancer activity.\n", - "Section": "CCC.LB.C01 Enforce and Detect Rate Limiting", + "FamilyDescription": "Controls that detect anomalous traffic and record load-balancer activity. ", + "Section": "CCC.LB.CN01 Enforce and Detect Rate Limiting", "SubSection": "", "SubSectionObjective": "Detect and throttle malicious or excessive requests to prevent downstream resource exhaustion and brute-force activity.", "Applicability": [ @@ -1852,7 +1136,7 @@ "tlp-amber", "tlp-red" ], - "Recommendation": "Implement per-IP token-bucket limits with and verify via\nsynthetic traffic tests.\n", + "Recommendation": "Implement per-IP token-bucket limits with and verify via synthetic traffic tests. ", "SectionThreatMappings": [ { "ReferenceId": "LB", @@ -1885,13 +1169,13 @@ "Checks": [] }, { - "Id": "CCC.LB.C01.TR02", - "Description": "When throttling is invoked, the load balancer MUST\nrecord the event in the access log within 5 minutes\nfor alerting and trend analysis.", + "Id": "CCC.LB.CN01.AR02", + "Description": "When throttling is invoked, the load balancer MUST record the event in the access log within 5 minutes for alerting and trend analysis.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "Controls that detect anomalous traffic and record load-balancer activity.\n", - "Section": "CCC.LB.C01 Enforce and Detect Rate Limiting", + "FamilyDescription": "Controls that detect anomalous traffic and record load-balancer activity. ", + "Section": "CCC.LB.CN01 Enforce and Detect Rate Limiting", "SubSection": "", "SubSectionObjective": "Detect and throttle malicious or excessive requests to prevent downstream resource exhaustion and brute-force activity.", "Applicability": [ @@ -1899,7 +1183,7 @@ "tlp-amber", "tlp-red" ], - "Recommendation": "Enable access logging and configure metric filters\non HTTP 429 counts to trigger alerts.\n", + "Recommendation": "Enable access logging and configure metric filters on HTTP 429 counts to trigger alerts. ", "SectionThreatMappings": [ { "ReferenceId": "LB", @@ -1939,21 +1223,21 @@ ] }, { - "Id": "CCC.LB.C06.TR01", - "Description": "When more than 10 percent of targets change from healthy to\nunhealthy within five minutes, an alert MUST be issued.", + "Id": "CCC.LB.CN06.AR01", + "Description": "When more than 10 percent of targets change from healthy to unhealthy within five minutes, an alert MUST be issued.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "Controls that detect anomalous traffic and record load-balancer activity.\n", - "Section": "CCC.LB.C06 Secure Health-Check Telemetry", + "FamilyDescription": "Controls that detect anomalous traffic and record load-balancer activity. ", + "Section": "CCC.LB.CN06 Secure Health-Check Telemetry", "SubSection": "", - "SubSectionObjective": "Monitor health-check endpoints for tampering and alert on\nabnormal status changes.", + "SubSectionObjective": "Monitor health-check endpoints for tampering and alert on abnormal status changes.", "Applicability": [ "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Instrument metrics for health check results and target\nremoval events. Configure monitoring alarms to alert\non abnormal spikes in unhealthy targets.\n", + "Recommendation": "Instrument metrics for health check results and target removal events. Configure monitoring alarms to alert on abnormal spikes in unhealthy targets. ", "SectionThreatMappings": [ { "ReferenceId": "LB", @@ -1992,21 +1276,21 @@ ] }, { - "Id": "CCC.LB.C04.TR01", - "Description": "When routing weights change, the request MUST originate\nfrom an explicitly defined and trusted identity and MUST\nbe logged.", + "Id": "CCC.LB.CN04.AR01", + "Description": "When routing weights change, the request MUST originate from an explicitly defined and trusted identity and MUST be logged.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "Controls that restrict who can change or query load-balancer resources.\n", - "Section": "CCC.LB.C04 Enforce Distribution Policies", + "FamilyDescription": "Controls that restrict who can change or query load-balancer resources. ", + "Section": "CCC.LB.CN04 Enforce Distribution Policies", "SubSection": "", - "SubSectionObjective": "Ensure traffic-splitting weights and algorithms are modified\nonly by trusted identities.", + "SubSectionObjective": "Ensure traffic-splitting weights and algorithms are modified only by trusted identities.", "Applicability": [ "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Define a list of trusted principals allowed to modify\nrouting configurations. Enforce via conditional access\npolicies, and log changes using audit logging.\n", + "Recommendation": "Define a list of trusted principals allowed to modify routing configurations. Enforce via conditional access policies, and log changes using audit logging. ", "SectionThreatMappings": [ { "ReferenceId": "LB", @@ -2044,15 +1328,15 @@ ] }, { - "Id": "CCC.LB.C05.TR01", - "Description": "When stickiness is enabled, session cookies MUST expire\nwithin 30 minutes of inactivity.", + "Id": "CCC.LB.CN05.AR01", + "Description": "When stickiness is enabled, session cookies MUST expire within 30 minutes of inactivity.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "Controls that restrict who can change or query load-balancer resources.\n", - "Section": "CCC.LB.C05 Validate Session Affinity", + "FamilyDescription": "Controls that restrict who can change or query load-balancer resources. ", + "Section": "CCC.LB.CN05 Validate Session Affinity", "SubSection": "", - "SubSectionObjective": "Configure session persistence to minimise fixation and hijacking\nrisks.", + "SubSectionObjective": "Configure session persistence to minimise fixation and hijacking risks.", "Applicability": [ "tlp-green", "tlp-amber", @@ -2090,15 +1374,15 @@ ] }, { - "Id": "CCC.LB.C09.TR01", - "Description": "When an API call originates outside the approved CIDR\nset, the request MUST be denied.", + "Id": "CCC.LB.CN09.AR01", + "Description": "When an API call originates outside the approved CIDR set, the request MUST be denied.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "Controls that restrict who can change or query load-balancer resources.\n", - "Section": "CCC.LB.C09 Restrict Management API Access", + "FamilyDescription": "Controls that restrict who can change or query load-balancer resources. ", + "Section": "CCC.LB.CN09 Restrict Management API Access", "SubSection": "", - "SubSectionObjective": "Limit load-balancer API calls to authorised identities and\ntrusted networks.", + "SubSectionObjective": "Limit load-balancer API calls to authorised identities and trusted networks.", "Applicability": [ "tlp-green", "tlp-amber", @@ -2138,15 +1422,15 @@ ] }, { - "Id": "CCC.LB.C02.TR01", - "Description": "When concurrent connections reach 80 percent of capacity, the\nautoscaling group MUST add at least one instance within five\nminutes.", + "Id": "CCC.LB.CN02.AR01", + "Description": "When concurrent connections reach 80 percent of capacity, the autoscaling group MUST add at least one instance within five minutes.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls that preserve availability and confidentiality of\ntraffic processed by the load balancer.\n", - "Section": "CCC.LB.C02 Auto-Scale Load Balancer Capacity", + "FamilyDescription": "Controls that preserve availability and confidentiality of traffic processed by the load balancer. ", + "Section": "CCC.LB.CN02 Auto-Scale Load Balancer Capacity", "SubSection": "", - "SubSectionObjective": "Expand load-balancer capacity to maintain availability during traffic\nspikes.", + "SubSectionObjective": "Expand load-balancer capacity to maintain availability during traffic spikes.", "Applicability": [ "tlp-green", "tlp-amber", @@ -2180,15 +1464,15 @@ "Checks": [] }, { - "Id": "CCC.LB.C07.TR01", - "Description": "When responses pass through the load balancer, the\n\"Server\" header MUST be replaced with \"lb\".", + "Id": "CCC.LB.CN07.AR01", + "Description": "When responses pass through the load balancer, the \"Server\" header MUST be replaced with \"lb\".", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls that preserve availability and confidentiality of\ntraffic processed by the load balancer.\n", - "Section": "CCC.LB.C07 Scrub Sensitive Headers", + "FamilyDescription": "Controls that preserve availability and confidentiality of traffic processed by the load balancer. ", + "Section": "CCC.LB.CN07 Scrub Sensitive Headers", "SubSection": "", - "SubSectionObjective": "Remove headers that disclose internal details or software\nversions from HTTP responses.", + "SubSectionObjective": "Remove headers that disclose internal details or software versions from HTTP responses.", "Applicability": [ "tlp-green", "tlp-amber", @@ -2222,15 +1506,15 @@ "Checks": [] }, { - "Id": "CCC.LB.C08.TR01", - "Description": "When a certificate is within 30 days of expiry, automated renewal\nMUST complete and deploy a new certificate within 24 hours.", + "Id": "CCC.LB.CN08.AR01", + "Description": "When a certificate is within 30 days of expiry, automated renewal MUST complete and deploy a new certificate within 24 hours.", "Attributes": [ { "FamilyName": "Encryption", "FamilyDescription": "Controls that ensure trustworthy TLS certificates and ciphers.", - "Section": "CCC.LB.C08 Automate Certificate Renewal", + "Section": "CCC.LB.CN08 Automate Certificate Renewal", "SubSection": "", - "SubSectionObjective": "Maintain valid TLS certificates by automating renewal and\ndeployment before expiry.", + "SubSectionObjective": "Maintain valid TLS certificates by automating renewal and deployment before expiry.", "Applicability": [ "tlp-green", "tlp-amber", @@ -2261,21 +1545,18 @@ ] } ], - "Checks": [ - "app_minimum_tls_version_12", - "storage_ensure_minimum_tls_version_12" - ] + "Checks": [] }, { - "Id": "CCC.Logging.C01.TR01", - "Description": "When a new cloud account is created, provider-level audit and network flow logging MUST be\nenabled by default and directed to the central sink.", + "Id": "CCC.Logging.CN01.AR01", + "Description": "When a new cloud account is created, provider-level audit and network flow logging MUST be enabled by default and directed to the central sink.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data.\n", - "Section": "CCC.Logging.C01 Centralized and Comprehensive Log Aggregation", + "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data. ", + "Section": "CCC.Logging.CN01 Centralized and Comprehensive Log Aggregation", "SubSection": "", - "SubSectionObjective": "Ensure all operational and security logs from across the cloud environment, including\napplications, operating systems, network traffic, and cloud service activity, are captured\nautomatically and streamed to a central, secure log management service.", + "SubSectionObjective": "Ensure all operational and security logs from across the cloud environment, including applications, operating systems, network traffic, and cloud service activity, are captured automatically and streamed to a central, secure log management service.", "Applicability": [ "tlp-clear", "tlp-green", @@ -2317,15 +1598,15 @@ ] }, { - "Id": "CCC.Logging.C01.TR02", - "Description": "When a new cloud compute resource is deployed, it MUST be configured to forward all relevant\nlogs (e.g., OS, application, service logs) to the central log sink.", + "Id": "CCC.Logging.CN01.AR02", + "Description": "When a new cloud compute resource is deployed, it MUST be configured to forward all relevant logs (e.g., OS, application, service logs) to the central log sink.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data.\n", - "Section": "CCC.Logging.C01 Centralized and Comprehensive Log Aggregation", + "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data. ", + "Section": "CCC.Logging.CN01 Centralized and Comprehensive Log Aggregation", "SubSection": "", - "SubSectionObjective": "Ensure all operational and security logs from across the cloud environment, including\napplications, operating systems, network traffic, and cloud service activity, are captured\nautomatically and streamed to a central, secure log management service.", + "SubSectionObjective": "Ensure all operational and security logs from across the cloud environment, including applications, operating systems, network traffic, and cloud service activity, are captured automatically and streamed to a central, secure log management service.", "Applicability": [ "tlp-clear", "tlp-green", @@ -2367,15 +1648,15 @@ ] }, { - "Id": "CCC.Logging.C02.TR01", - "Description": "When a new log bucket or stream is created, its retention policy MUST be configured\nin accordance with organisation's data retention policy.", + "Id": "CCC.Logging.CN02.AR01", + "Description": "When a new log bucket or stream is created, its retention policy MUST be configured in accordance with organisation's data retention policy.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data.\n", - "Section": "CCC.Logging.C02 Enforce Data Retention Policy for Logs", + "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data. ", + "Section": "CCC.Logging.CN02 Enforce Data Retention Policy for Logs", "SubSection": "", - "SubSectionObjective": "Ensure that the retention period configured for logs aligns with the organization's\ndata retention policy.", + "SubSectionObjective": "Ensure that the retention period configured for logs aligns with the organization's data retention policy.", "Applicability": [ "tlp-clear", "tlp-green", @@ -2412,15 +1693,15 @@ ] }, { - "Id": "CCC.Logging.C02.TR02", - "Description": "When a query is performed to retrieve log events older than the number of days defined\nin the organisation's data retention policy, it MUST return an empty result.", + "Id": "CCC.Logging.CN02.AR02", + "Description": "When a query is performed to retrieve log events older than the number of days defined in the organisation's data retention policy, it MUST return an empty result.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data.\n", - "Section": "CCC.Logging.C02 Enforce Data Retention Policy for Logs", + "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data. ", + "Section": "CCC.Logging.CN02 Enforce Data Retention Policy for Logs", "SubSection": "", - "SubSectionObjective": "Ensure that the retention period configured for logs aligns with the organization's\ndata retention policy.", + "SubSectionObjective": "Ensure that the retention period configured for logs aligns with the organization's data retention policy.", "Applicability": [ "tlp-clear", "tlp-green", @@ -2459,20 +1740,20 @@ ] }, { - "Id": "CCC.AuditLog.C08.TR01", - "Description": "When an attempt is made to modify or delete data before the object\nlock period expires, then the action MUST be denied.", + "Id": "CCC.AuditLog.CN08.AR01", + "Description": "When an attempt is made to modify or delete data before the object lock period expires, then the action MUST be denied.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data.\n", - "Section": "CCC.Logging.C03 Enable Object Lock On Log Bucket", + "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data. ", + "Section": "CCC.Logging.CN03 Enable Object Lock On Log Bucket", "SubSection": "", - "SubSectionObjective": "Ensure log immutability by enabling Write Once, Read Many (WORM) protection\nusing object lock on log storage buckets. This prevents logs from being modified\nor deleted during the defined retention period, supporting compliance and forensic\nintegrity.", + "SubSectionObjective": "Ensure log immutability by enabling Write Once, Read Many (WORM) protection using object lock on log storage buckets. This prevents logs from being modified or deleted during the defined retention period, supporting compliance and forensic integrity.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Configure object lock policy.\n", + "Recommendation": "Configure object lock policy. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -2501,20 +1782,20 @@ "Checks": [] }, { - "Id": "CCC.AuditLog.C04.TR01", + "Id": "CCC.AuditLog.CN04.AR01", "Description": "When restricted fields are accessed by unauthorized users, then those fields MUST remain masked.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "Controls that restrict who can access and modify logs.\n", - "Section": "CCC.Logging.C04 Restrict Field And Log Type Access", + "FamilyDescription": "Controls that restrict who can access and modify logs. ", + "Section": "CCC.Logging.CN04 Restrict Field And Log Type Access", "SubSection": "", - "SubSectionObjective": "Configure access to logs to follow the principle of least privilege in particular where technically\npossible limit the log fields users have access to to prevent accidental exposure to sensitive\ninformation such as PII.", + "SubSectionObjective": "Configure access to logs to follow the principle of least privilege in particular where technically possible limit the log fields users have access to to prevent accidental exposure to sensitive information such as PII.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Review field level access controls on log data.\n", + "Recommendation": "Review field level access controls on log data. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -2552,21 +1833,21 @@ ] }, { - "Id": "CCC.Logging.C05.TR01", - "Description": "When a log storage bucket is created, the bucket's access control settings MUST\nexplicitly deny public read and write access.", + "Id": "CCC.Logging.CN05.AR01", + "Description": "When a log storage bucket is created, the bucket's access control settings MUST explicitly deny public read and write access.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "Controls that restrict who can access and modify logs.\n", - "Section": "CCC.Logging.C05 Ensure Log Bucket is Not Publicly Accessible", + "FamilyDescription": "Controls that restrict who can access and modify logs. ", + "Section": "CCC.Logging.CN05 Ensure Log Bucket is Not Publicly Accessible", "SubSection": "", - "SubSectionObjective": "Ensure that log storage buckets are not publicly accessible to prevent unauthorized\naccess to sensitive log data. In addition, logs should be replicated to another cloud\nregion to enhance availability, durability, and support disaster recovery requirements.", + "SubSectionObjective": "Ensure that log storage buckets are not publicly accessible to prevent unauthorized access to sensitive log data. In addition, logs should be replicated to another cloud region to enhance availability, durability, and support disaster recovery requirements.", "Applicability": [ "tlp-red", "tlp-amber", "tlp-green" ], - "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access.\nRegularly review bucket permissions to ensure no public access has been inadvertently granted.\n", + "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access. Regularly review bucket permissions to ensure no public access has been inadvertently granted. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -2600,21 +1881,21 @@ ] }, { - "Id": "CCC.Logging.C05.TR02", - "Description": "When the URL of a log storage bucket's object is accessed publicly, the action MUST be denied\nby bucket policy.", + "Id": "CCC.Logging.CN05.AR02", + "Description": "When the URL of a log storage bucket's object is accessed publicly, the action MUST be denied by bucket policy.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "Controls that restrict who can access and modify logs.\n", - "Section": "CCC.Logging.C05 Ensure Log Bucket is Not Publicly Accessible", + "FamilyDescription": "Controls that restrict who can access and modify logs. ", + "Section": "CCC.Logging.CN05 Ensure Log Bucket is Not Publicly Accessible", "SubSection": "", - "SubSectionObjective": "Ensure that log storage buckets are not publicly accessible to prevent unauthorized\naccess to sensitive log data. In addition, logs should be replicated to another cloud\nregion to enhance availability, durability, and support disaster recovery requirements.", + "SubSectionObjective": "Ensure that log storage buckets are not publicly accessible to prevent unauthorized access to sensitive log data. In addition, logs should be replicated to another cloud region to enhance availability, durability, and support disaster recovery requirements.", "Applicability": [ "tlp-red", "tlp-amber", "tlp-green" ], - "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access.\nRegularly review bucket permissions to ensure no public access has been inadvertently granted.\n", + "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access. Regularly review bucket permissions to ensure no public access has been inadvertently granted. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -2649,15 +1930,15 @@ ] }, { - "Id": "CCC.Logging.C06.TR01", - "Description": "When a single principal executes an anomalously high number of log queries,\nan alert MUST be generated.", + "Id": "CCC.Logging.CN06.AR01", + "Description": "When a single principal executes an anomalously high number of log queries, an alert MUST be generated.", "Attributes": [ { "FamilyName": "Logging and Monitoring", - "FamilyDescription": "Controls that collect, alert, and retain logging-related events.\n", - "Section": "CCC.Logging.C06 Detect and Alert on Potential Log Exfiltration", + "FamilyDescription": "Controls that collect, alert, and retain logging-related events. ", + "Section": "CCC.Logging.CN06 Detect and Alert on Potential Log Exfiltration", "SubSection": "", - "SubSectionObjective": "Identify and alert on anomalous data access patterns that may indicate an attempt\nto exfiltrate log data.", + "SubSectionObjective": "Identify and alert on anomalous data access patterns that may indicate an attempt to exfiltrate log data.", "Applicability": [ "tlp-green", "tlp-amber", @@ -2696,15 +1977,15 @@ ] }, { - "Id": "CCC.Logging.C07.TR01", - "Description": "When an audit log event is recorded that corresponds to a modification of the logging service\nconfiguration such as disabling a log trail, deleting a log sink, or altering a log forwarding rule,\nan alert MUST be generated.", + "Id": "CCC.Logging.CN07.AR01", + "Description": "When an audit log event is recorded that corresponds to a modification of the logging service configuration such as disabling a log trail, deleting a log sink, or altering a log forwarding rule, an alert MUST be generated.", "Attributes": [ { "FamilyName": "Logging and Monitoring", - "FamilyDescription": "Controls that collect, alert, and retain logging-related events.\n", - "Section": "CCC.Logging.C07 Detect and Alert on Log Service Tampering", + "FamilyDescription": "Controls that collect, alert, and retain logging-related events. ", + "Section": "CCC.Logging.CN07 Detect and Alert on Log Service Tampering", "SubSection": "", - "SubSectionObjective": "Alert when any component of the critical logging infrastructure is disabled, modified,\nor deleted, indicating a defense evasion attempt.", + "SubSectionObjective": "Alert when any component of the critical logging infrastructure is disabled, modified, or deleted, indicating a defense evasion attempt.", "Applicability": [ "tlp-clear", "tlp-green", @@ -2755,13 +2036,13 @@ ] }, { - "Id": "CCC.ObjStor.C01.TR01", + "Id": "CCC.ObjStor.CN01.AR01", "Description": "When a request is made to read a protected bucket, the service MUST prevent any request using KMS keys not listed as trusted by the organization.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C01 Prevent Unencrypted Requests", + "Section": "CCC.CN01 Prevent Unencrypted Requests", "SubSection": "CCC.ObjStor.C01 Prevent Requests to Buckets or Objects with Untrusted KMS Keys", "SubSectionObjective": "Prevent any requests to object storage buckets or objects using untrusted KMS keys to protect against unauthorized data encryption that can impact data availability and integrity.", "Applicability": [ @@ -2815,13 +2096,13 @@ ] }, { - "Id": "CCC.ObjStor.C01.TR02", + "Id": "CCC.ObjStor.CN01.AR02", "Description": "When a request is made to read a protected object, the service MUST prevent any request using KMS keys not listed as trusted by the organization.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C01 Prevent Unencrypted Requests", + "Section": "CCC.CN01 Prevent Unencrypted Requests", "SubSection": "CCC.ObjStor.C01 Prevent Requests to Buckets or Objects with Untrusted KMS Keys", "SubSectionObjective": "Prevent any requests to object storage buckets or objects using untrusted KMS keys to protect against unauthorized data encryption that can impact data availability and integrity.", "Applicability": [ @@ -2877,13 +2158,13 @@ ] }, { - "Id": "CCC.ObjStor.C01.TR03", + "Id": "CCC.ObjStor.CN01.AR03", "Description": "When a request is made to write to a bucket, the service MUST prevent any request using KMS keys not listed as trusted by the organization.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C01 Prevent Unencrypted Requests", + "Section": "CCC.CN01 Prevent Unencrypted Requests", "SubSection": "CCC.ObjStor.C01 Prevent Requests to Buckets or Objects with Untrusted KMS Keys", "SubSectionObjective": "Prevent any requests to object storage buckets or objects using untrusted KMS keys to protect against unauthorized data encryption that can impact data availability and integrity.", "Applicability": [ @@ -2940,13 +2221,13 @@ ] }, { - "Id": "CCC.ObjStor.C01.TR04", + "Id": "CCC.ObjStor.CN01.AR04", "Description": "When a request is made to write to an object, the service MUST prevent any request using KMS keys not listed as trusted by the organization.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C01 Prevent Unencrypted Requests", + "Section": "CCC.CN01 Prevent Unencrypted Requests", "SubSection": "CCC.ObjStor.C01 Prevent Requests to Buckets or Objects with Untrusted KMS Keys", "SubSectionObjective": "Prevent any requests to object storage buckets or objects using untrusted KMS keys to protect against unauthorized data encryption that can impact data availability and integrity.", "Applicability": [ @@ -3001,13 +2282,13 @@ ] }, { - "Id": "CCC.ObjStor.C03.TR01", + "Id": "CCC.ObjStor.CN03.AR01", "Description": "When an object storage bucket deletion is attempted, the bucket MUST be fully recoverable for a set time-frame after deletion is requested.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C03 Implement Multi-factor Authentication (MFA) for Access", + "Section": "CCC.CN03 Implement Multi-factor Authentication (MFA) for Access", "SubSection": "CCC.ObjStor.C03 Prevent Bucket Deletion Through Irrevocable Bucket Retention Policy", "SubSectionObjective": "Ensure that object storage bucket is not deleted after creation, and that the preventative measure cannot be unset.", "Applicability": [ @@ -3060,13 +2341,13 @@ ] }, { - "Id": "CCC.ObjStor.C03.TR02", + "Id": "CCC.ObjStor.CN03.AR02", "Description": "When an attempt is made to modify the retention policy for an object storage bucket, the service MUST prevent the policy from being modified.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C03 Implement Multi-factor Authentication (MFA) for Access", + "Section": "CCC.CN03 Implement Multi-factor Authentication (MFA) for Access", "SubSection": "CCC.ObjStor.C03 Prevent Bucket Deletion Through Irrevocable Bucket Retention Policy", "SubSectionObjective": "Ensure that object storage bucket is not deleted after creation, and that the preventative measure cannot be unset.", "Applicability": [ @@ -3116,13 +2397,13 @@ "Checks": [] }, { - "Id": "CCC.ObjStor.C04.TR01", + "Id": "CCC.ObjStor.CN04.AR01", "Description": "When an object is uploaded to the object storage system, the object MUST automatically receive a default retention policy that prevents premature deletion or modification.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C04 Log All Access and Changes", + "Section": "CCC.CN04 Log All Access and Changes", "SubSection": "CCC.ObjStor.C04 Objects have an Effective Retention Policy by Default", "SubSectionObjective": "Ensure that all objects stored in the object storage system have a retention policy applied by default, preventing premature deletion or modification of objects and ensuring compliance with data retention regulations.", "Applicability": [ @@ -3176,13 +2457,13 @@ ] }, { - "Id": "CCC.ObjStor.C04.TR02", + "Id": "CCC.ObjStor.CN04.AR02", "Description": "When an attempt is made to delete or modify an object that is subject to an active retention policy, the service MUST prevent the action from being completed.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C04 Log All Access and Changes", + "Section": "CCC.CN04 Log All Access and Changes", "SubSection": "CCC.ObjStor.C04 Objects have an Effective Retention Policy by Default", "SubSectionObjective": "Ensure that all objects stored in the object storage system have a retention policy applied by default, preventing premature deletion or modification of objects and ensuring compliance with data retention regulations.", "Applicability": [ @@ -3235,13 +2516,13 @@ ] }, { - "Id": "CCC.ObjStor.C05.TR01", + "Id": "CCC.ObjStor.CN05.AR01", "Description": "When an object is uploaded to the object storage bucket, the object MUST be stored with a unique identifier.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C05 Prevent Access from Untrusted Entities", + "Section": "CCC.CN05 Prevent Access from Untrusted Entities", "SubSection": "CCC.ObjStor.C05 Versioning is Enabled for All Objects in the Bucket", "SubSectionObjective": "Ensure that versioning is enabled for all objects stored in the object storage bucket to enable recovery of previous versions of objects in case of loss or corruption.", "Applicability": [ @@ -3293,13 +2574,13 @@ ] }, { - "Id": "CCC.ObjStor.C05.TR02", + "Id": "CCC.ObjStor.CN05.AR02", "Description": "When an object is modified, the service MUST assign a new unique identifier to the modified object to differentiate it from the previous version.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C05 Prevent Access from Untrusted Entities", + "Section": "CCC.CN05 Prevent Access from Untrusted Entities", "SubSection": "CCC.ObjStor.C05 Versioning is Enabled for All Objects in the Bucket", "SubSectionObjective": "Ensure that versioning is enabled for all objects stored in the object storage bucket to enable recovery of previous versions of objects in case of loss or corruption.", "Applicability": [ @@ -3351,13 +2632,13 @@ ] }, { - "Id": "CCC.ObjStor.C05.TR03", + "Id": "CCC.ObjStor.CN05.AR03", "Description": "When an object is modified, the service MUST allow for recovery of previous versions of the object.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C05 Prevent Access from Untrusted Entities", + "Section": "CCC.CN05 Prevent Access from Untrusted Entities", "SubSection": "CCC.ObjStor.C05 Versioning is Enabled for All Objects in the Bucket", "SubSectionObjective": "Ensure that versioning is enabled for all objects stored in the object storage bucket to enable recovery of previous versions of objects in case of loss or corruption.", "Applicability": [ @@ -3409,13 +2690,13 @@ ] }, { - "Id": "CCC.ObjStor.C05.TR04", + "Id": "CCC.ObjStor.CN05.AR04", "Description": "When an object is deleted, the service MUST retain other versions of the object to allow for recovery of previous versions.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C05 Prevent Access from Untrusted Entities", + "Section": "CCC.CN05 Prevent Access from Untrusted Entities", "SubSection": "CCC.ObjStor.C05 Versioning is Enabled for All Objects in the Bucket", "SubSectionObjective": "Ensure that versioning is enabled for all objects stored in the object storage bucket to enable recovery of previous versions of objects in case of loss or corruption.", "Applicability": [ @@ -3467,13 +2748,13 @@ ] }, { - "Id": "CCC.ObjStor.C06.TR01", + "Id": "CCC.ObjStor.CN06.AR01", "Description": "When an object storage bucket is accessed, the service MUST store access logs in a separate data store.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C06 Prevent Deployment in Restricted Regions", + "Section": "CCC.CN06 Prevent Deployment in Restricted Regions", "SubSection": "CCC.ObjStor.C06 Access Logs are Stored in a Separate Data Store", "SubSectionObjective": "Ensure that access logs for object storage buckets are stored in a separate data store to protect against unauthorized access, tampering, or deletion of logs (Logbuckets are exempt from this requirement, but must be tlp-red).", "Applicability": [ @@ -3528,13 +2809,13 @@ ] }, { - "Id": "CCC.ObjStor.C02.TR01", + "Id": "CCC.ObjStor.CN02.AR01", "Description": "When a permission set is allowed for an object in a bucket, the service MUST allow the same permission set to access all objects in the same bucket.", "Attributes": [ { "FamilyName": "Identity and Access Management", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C02 Ensure Data Encryption at Rest for All Stored Data", + "Section": "CCC.CN02 Ensure Data Encryption at Rest for All Stored Data", "SubSection": "CCC.ObjStor.C02 Enforce Uniform Bucket-level Access to Prevent Inconsistent Permissions", "SubSectionObjective": "Ensure that uniform bucket-level access is enforced across all object storage buckets. This prevents the use of ad-hoc or inconsistent object-level permissions, ensuring centralized, consistent, and secure access management in accordance with the principle of least privilege.", "Applicability": [ @@ -3588,13 +2869,13 @@ ] }, { - "Id": "CCC.ObjStor.C02.TR02", + "Id": "CCC.ObjStor.CN02.AR02", "Description": "When a permission set is denied for an object in a bucket, the service MUST deny the same permission set to access all objects in the same bucket.", "Attributes": [ { "FamilyName": "Identity and Access Management", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C02 Ensure Data Encryption at Rest for All Stored Data", + "Section": "CCC.CN02 Ensure Data Encryption at Rest for All Stored Data", "SubSection": "CCC.ObjStor.C02 Enforce Uniform Bucket-level Access to Prevent Inconsistent Permissions", "SubSectionObjective": "Ensure that uniform bucket-level access is enforced across all object storage buckets. This prevents the use of ad-hoc or inconsistent object-level permissions, ensuring centralized, consistent, and secure access management in accordance with the principle of least privilege.", "Applicability": [ @@ -3648,1001 +2929,9 @@ "storage_ensure_private_endpoints_in_storage_accounts" ] }, - { - "Id": "CCC.MLDE.CN01.AR01", - "Description": "Verify that only authorized users can access MLDE resources,\nand that access modes are properly defined and enforced.", - "Attributes": [ - { - "FamilyName": "Identity and Access Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN01 Define Access Mode for ML Development Environments", - "SubSection": "", - "SubSectionObjective": "Ensure that access to Machine Learning Development Environment (MLDE)\nresources is strictly defined and controlled.\nOnly authorized users with appropriate permissions can access these environments,\nmitigating the risk of unauthorized access, data leakage, or service disruption.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01", - "CCC.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-3" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.1.1", - "2013 A.9.2.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-2", - "AC-3" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-01", - "IAM-02" - ] - } - ] - } - ], - "Checks": [ - "aks_cluster_rbac_enabled", - "aks_clusters_public_access_disabled", - "aks_network_policy_enabled", - "app_ensure_auth_is_set_up", - "app_register_with_identity", - "app_function_identity_is_configured", - "app_function_identity_without_admin_privileges", - "app_function_not_publicly_accessible", - "app_function_access_keys_configured", - "keyvault_rbac_enabled", - "keyvault_private_endpoints", - "keyvault_access_only_through_private_endpoints", - "iam_custom_role_has_permissions_to_administer_resource_locks", - "iam_role_user_access_admin_restricted", - "iam_subscription_roles_owner_custom_not_created", - "entra_policy_user_consent_for_verified_apps", - "entra_security_defaults_enabled", - "entra_trusted_named_locations_exists", - "entra_global_admin_in_less_than_five_users", - "entra_non_privileged_user_has_mfa", - "entra_privileged_user_has_mfa", - "entra_policy_default_users_cannot_create_security_groups", - "entra_policy_ensure_default_user_cannot_create_apps", - "entra_users_cannot_create_microsoft_365_groups" - ] - }, - { - "Id": "CCC.MLDE.CN03.AR01", - "Description": "Verify that root access is disabled on MLDE instances containing sensitive data.", - "Attributes": [ - { - "FamilyName": "Identity and Access Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN03 Disable Root Access on MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Prevent users from obtaining root access on MLDE instances to reduce the\nrisk of unauthorized system modifications and potential security breaches.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-4" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-6" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-08", - "IAM-12" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.2.3" - ] - } - ] - } - ], - "Checks": [ - "aks_clusters_created_with_private_nodes", - "aks_clusters_public_access_disabled", - "aks_network_policy_enabled", - "app_function_not_publicly_accessible", - "app_function_identity_without_admin_privileges", - "iam_role_user_access_admin_restricted", - "vm_jit_access_enabled", - "vm_linux_enforce_ssh_authentication", - "app_function_identity_is_configured" - ] - }, - { - "Id": "CCC.MLDE.CN03.AR02", - "Description": "For MLDE instances without sensitive data, ensure that root access is only\nenabled when necessary and properly authorized.", - "Attributes": [ - { - "FamilyName": "Identity and Access Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN03 Disable Root Access on MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Prevent users from obtaining root access on MLDE instances to reduce the\nrisk of unauthorized system modifications and potential security breaches.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-4" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-6" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-08", - "IAM-12" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.2.3" - ] - } - ] - } - ], - "Checks": [ - "vm_jit_access_enabled", - "vm_linux_enforce_ssh_authentication", - "app_function_identity_without_admin_privileges", - "app_function_identity_is_configured", - "iam_role_user_access_admin_restricted", - "iam_subscription_roles_owner_custom_not_created", - "entra_global_admin_in_less_than_five_users", - "entra_privileged_user_has_mfa", - "entra_conditional_access_policy_require_mfa_for_management_api" - ] - }, - { - "Id": "CCC.MLDE.CN04.AR01", - "Description": "Verify that terminal access is disabled on MLDE instances containing sensitive data.", - "Attributes": [ - { - "FamilyName": "Identity and Access Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN04 Disable Terminal Access on MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Prevent users from accessing the terminal on MLDE instances to limit the risk of\nunauthorized commands and potential system compromise.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-4" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-6" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-08" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.2.3" - ] - } - ] - } - ], - "Checks": [ - "vm_jit_access_enabled", - "vm_linux_enforce_ssh_authentication" - ] - }, - { - "Id": "CCC.MLDE.CN04.AR02", - "Description": "For MLDE instances without sensitive data, ensure that terminal access is only\nenabled when necessary and properly authorized.", - "Attributes": [ - { - "FamilyName": "Identity and Access Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN04 Disable Terminal Access on MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Prevent users from accessing the terminal on MLDE instances to limit the risk of\nunauthorized commands and potential system compromise.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-4" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-6" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-08" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.2.3" - ] - } - ] - } - ], - "Checks": [ - "vm_jit_access_enabled", - "vm_linux_enforce_ssh_authentication" - ] - }, - { - "Id": "CCC.MLDE.CN02.AR01", - "Description": "Confirm that file download functionality is disabled on MLDE instances containing sensitive data.", - "Attributes": [ - { - "FamilyName": "Data Protection", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN02 Disable File Downloads on MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Prevent unauthorized file downloads from MLDE instances to protect sensitive data from being exfiltrated.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH02", - "CCC.TH02" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.DS-5" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "DSI-05", - "DSI-07" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.13.2.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-7", - "SC-8" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.MLDE.CN02.AR02", - "Description": "For MLDE instances without sensitive data, ensure that file downloads are monitored and logged.", - "Attributes": [ - { - "FamilyName": "Data Protection", - "FamilyDescription": "TODO: Describe this control family", - "Section": "", - "SubSection": "CCC.MLDE.CN02 Disable File Downloads on MLDE Instances", - "SubSectionObjective": "Prevent unauthorized file downloads from MLDE instances to protect sensitive data from being exfiltrated.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH02", - "CCC.TH02" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.DS-5" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "DSI-05", - "DSI-07" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.13.2.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-7", - "SC-8" - ] - } - ] - } - ], - "Checks": [ - "monitor_diagnostic_settings_exists", - "monitor_diagnostic_setting_with_appropriate_categories" - ] - }, - { - "Id": "CCC.MLDE.CN05.AR01", - "Description": "Verify that only approved VM and container images can be selected when creating MLDE instances.", - "Attributes": [ - { - "FamilyName": "Configuration Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "", - "SubSection": "CCC.MLDE.CN05 Restrict Environment Options on MLDE Instances", - "SubSectionObjective": "Limit the virtual machine and container image options available when creating\nnew MLDE instances to approved and secure configurations.", - "Applicability": [ - "tlp-red", - "tlp-amber" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH04" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.IP-1" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "TVM-02" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.12.5.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "CM-2" - ] - } - ] - } - ], - "Checks": [ - "vm_ensure_using_approved_images", - "vm_desired_sku_size", - "containerregistry_not_publicly_accessible", - "containerregistry_uses_private_link" - ] - }, - { - "Id": "CCC.MLDE.CN05.AR02", - "Description": "Attempt to create an MLDE instance with an unapproved image and confirm that it is denied.", - "Attributes": [ - { - "FamilyName": "Configuration Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "", - "SubSection": "CCC.MLDE.CN05 Restrict Environment Options on MLDE Instances", - "SubSectionObjective": "Limit the virtual machine and container image options available when creating\nnew MLDE instances to approved and secure configurations.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH04" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.IP-1" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "TVM-02" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.12.5.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "CM-2" - ] - } - ] - } - ], - "Checks": [ - "vm_ensure_using_approved_images" - ] - }, - { - "Id": "CCC.MLDE.CN06.AR01", - "Description": "Verify that automatic scheduled upgrades are enabled on user-managed\nMLDE instances containing sensitive data.", - "Attributes": [ - { - "FamilyName": "Vulnerability Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "", - "SubSection": "CCC.MLDE.CN06 Require Automatic Scheduled Upgrades on User-Managed MLDE Instances", - "SubSectionObjective": "Ensure that MLDE instances are kept up-to-date with the\nlatest security patches by enforcing automatic scheduled upgrades.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH04", - "CCC.TH06" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.IP-12" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "TVM-01", - "TVM-02" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.12.6.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SI-2" - ] - } - ] - } - ], - "Checks": [ - "defender_ensure_system_updates_are_applied" - ] - }, - { - "Id": "CCC.MLDE.CN06.AR02", - "Description": "Ensure that the upgrade schedule is appropriately configured and\ndoes not interfere with critical operations.", - "Attributes": [ - { - "FamilyName": "Vulnerability Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "", - "SubSection": "CCC.MLDE.CN06 Require Automatic Scheduled Upgrades on User-Managed MLDE Instances", - "SubSectionObjective": "Ensure that MLDE instances are kept up-to-date with the\nlatest security patches by enforcing automatic scheduled upgrades.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH04", - "CCC.TH06" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.IP-12" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "TVM-01", - "TVM-02" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.12.6.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SI-2" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.MLDE.CN07.AR01", - "Description": "Verify that MLDE instances containing sensitive data cannot be accessed via public IP addresses.", - "Attributes": [ - { - "FamilyName": "Network Security", - "FamilyDescription": "TODO: Describe this control family", - "Section": "", - "SubSection": "CCC.MLDE.CN07 Restrict Public IP Access on MLDE Instances", - "SubSectionObjective": "Prevent public IP access to MLDE instances to reduce exposure to the internet and enhance security.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH02", - "CCC.VPC.TH02" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-3" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "SEF-05" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.13.1.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-7" - ] - } - ] - } - ], - "Checks": [ - "aks_clusters_created_with_private_nodes", - "aks_clusters_public_access_disabled", - "containerregistry_not_publicly_accessible", - "containerregistry_uses_private_link", - "keyvault_private_endpoints", - "keyvault_access_only_through_private_endpoints", - "storage_blob_public_access_level_is_disabled", - "storage_ensure_private_endpoints_in_storage_accounts", - "storage_default_network_access_rule_is_denied", - "network_http_internet_access_restricted", - "network_rdp_internet_access_restricted", - "network_ssh_internet_access_restricted", - "network_udp_internet_access_restricted", - "network_public_ip_shodan" - ] - }, - { - "Id": "CCC.MLDE.CN07.AR02", - "Description": "For MLDE instances without sensitive data requiring public access,\nensure that appropriate security controls are in place and access is approved.", - "Attributes": [ - { - "FamilyName": "Network Security", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN07 Restrict Public IP Access on MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Prevent public IP access to MLDE instances to reduce exposure to the internet and enhance security.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH02", - "CCC.VPC.TH02" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-3" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "SEF-05" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.13.1.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-7" - ] - } - ] - } - ], - "Checks": [ - "aks_clusters_created_with_private_nodes", - "aks_clusters_public_access_disabled", - "containerregistry_not_publicly_accessible", - "containerregistry_uses_private_link", - "keyvault_private_endpoints", - "keyvault_access_only_through_private_endpoints", - "storage_ensure_private_endpoints_in_storage_accounts", - "storage_default_network_access_rule_is_denied", - "network_http_internet_access_restricted", - "network_rdp_internet_access_restricted", - "network_ssh_internet_access_restricted", - "network_udp_internet_access_restricted" - ] - }, - { - "Id": "CCC.MLDE.CN08.AR01", - "Description": "Verify that MLDE instances containing sensitive data can only be deployed in\napproved virtual networks with appropriate security controls.", - "Attributes": [ - { - "FamilyName": "Network Security", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN08 Restrict Virtual Networks for MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Limit the virtual networks that can be used when creating new MLDE instances to\nensure they are deployed within approved and secure network environments.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01", - "CCC.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-4" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-12" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.1.2" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-6" - ] - } - ] - } - ], - "Checks": [ - "aks_clusters_created_with_private_nodes", - "aks_clusters_public_access_disabled", - "aks_network_policy_enabled", - "app_function_vnet_integration_enabled", - "app_function_not_publicly_accessible", - "containerregistry_not_publicly_accessible", - "containerregistry_uses_private_link", - "keyvault_private_endpoints", - "keyvault_access_only_through_private_endpoints", - "storage_ensure_private_endpoints_in_storage_accounts", - "storage_default_network_access_rule_is_denied", - "network_http_internet_access_restricted", - "network_rdp_internet_access_restricted", - "network_ssh_internet_access_restricted", - "network_udp_internet_access_restricted" - ] - }, - { - "Id": "CCC.MLDE.CN08.AR02", - "Description": "Ensure that MLDE instances without sensitive data are deployed in\nnetworks that meet organizational security standards.", - "Attributes": [ - { - "FamilyName": "Network Security", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN08 Restrict Virtual Networks for MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Limit the virtual networks that can be used when creating new MLDE instances to\nensure they are deployed within approved and secure network environments.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01", - "CCC.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-4" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-12" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.1.2" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-6" - ] - } - ] - } - ], - "Checks": [ - "aks_clusters_created_with_private_nodes", - "aks_clusters_public_access_disabled", - "aks_network_policy_enabled", - "app_function_vnet_integration_enabled", - "containerregistry_not_publicly_accessible", - "containerregistry_uses_private_link", - "keyvault_private_endpoints", - "keyvault_access_only_through_private_endpoints", - "storage_ensure_private_endpoints_in_storage_accounts", - "storage_default_network_access_rule_is_denied", - "storage_ensure_azure_services_are_trusted_to_access_is_enabled", - "network_http_internet_access_restricted", - "network_rdp_internet_access_restricted", - "network_ssh_internet_access_restricted", - "network_udp_internet_access_restricted" - ] - }, - { - "Id": "CCC.Message.CN01.AR01", - "Description": "Attempt to publish a message without using a customer-managed encryption key\nand verify that the message is rejected or not stored.", - "Attributes": [ - { - "FamilyName": "Encryption", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.Message.CN01 Use Customer-Managed Encryption Keys (CMEK) for Messages", - "SubSection": "", - "SubSectionObjective": "Ensure that messages are encrypted using customer-managed encryption keys (CMEK)\nto provide enhanced control over encryption processes and keys, meeting compliance and security requirements.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.DS-1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-12", - "SC-13" - ] - } - ] - } - ], - "Checks": [ - "storage_ensure_encryption_with_customer_managed_keys", - "monitor_storage_account_with_activity_logs_cmk_encrypted" - ] - }, { "Id": "CCC.Monitor.CN01.AR01", - "Description": "When an External Monitoring system exceeds the anticipated rate of monitoring checks then\nRate Limiting MUST be applied and an Audit Alert MUST be generated.", + "Description": "When an External Monitoring system exceeds the anticipated rate of monitoring checks then Rate Limiting MUST be applied and an Audit Alert MUST be generated.", "Attributes": [ { "FamilyName": "Logging & Monitoring", @@ -4698,7 +2987,7 @@ }, { "Id": "CCC.Monitor.CN02.AR01", - "Description": "When an Custom or User-Defined Metric starts to flood a collector, then a rate limit MUST be applied\nto reduce the network impact of traffic and an alert must triggered.", + "Description": "When an Custom or User-Defined Metric starts to flood a collector, then a rate limit MUST be applied to reduce the network impact of traffic and an alert must triggered.", "Attributes": [ { "FamilyName": "Logging & Monitoring", @@ -4745,14 +3034,14 @@ }, { "Id": "CCC.Monitor.CN03.AR01", - "Description": "When external systems have approved access to internal systems not normally available for public access\nthen they MUST be secured to prevent unauthorised access jumping through to the internal systems and\nonly allow access to specific internal services.", + "Description": "When external systems have approved access to internal systems not normally available for public access then they MUST be secured to prevent unauthorised access jumping through to the internal systems and only allow access to specific internal services.", "Attributes": [ { "FamilyName": "Identity and Access Management", "FamilyDescription": "Controls designed to prevent unauthorised access to monitoring features.", "Section": "CCC.Monitor.CN03 Access External Monitoring", "SubSection": "", - "SubSectionObjective": "Control access to Synthetic monitoring solutions using API keys or Certificate based authentication to\nensure they don't become an attack path, preventing monitoring systems from forging network requests to\ngain access to internal systems.", + "SubSectionObjective": "Control access to Synthetic monitoring solutions using API keys or Certificate based authentication to ensure they don't become an attack path, preventing monitoring systems from forging network requests to gain access to internal systems.", "Applicability": [ "tlp-clear", "tlp-green", @@ -4793,7 +3082,7 @@ }, { "Id": "CCC.Monitor.CN04.AR01", - "Description": "When monitoring dashboards display degraded services which may become potential targets then the\ndashboard MUST be protected from unauthorised access.", + "Description": "When monitoring dashboards display degraded services which may become potential targets then the dashboard MUST be protected from unauthorised access.", "Attributes": [ { "FamilyName": "Identity and Access Management", @@ -4838,7 +3127,7 @@ }, { "Id": "CCC.Monitor.CN05.AR01", - "Description": "When monitoring services have generated an alert, the service MUST ensure only authorised\nresponders silence or acknowledge the alert.", + "Description": "When monitoring services have generated an alert, the service MUST ensure only authorised responders silence or acknowledge the alert.", "Attributes": [ { "FamilyName": "Identity and Access Management", @@ -4889,7 +3178,7 @@ "FamilyDescription": "Controls designed to prevent unauthorised access to monitoring features.", "Section": "CCC.Monitor.CN06 Metrics pushed for authorised services only", "SubSection": "", - "SubSectionObjective": "Use IAM to control which types of metrics or traces can be pushed by different system to avoid a compromised\nsystem pushing fabricated metrics about a different service", + "SubSectionObjective": "Use IAM to control which types of metrics or traces can be pushed by different system to avoid a compromised system pushing fabricated metrics about a different service", "Applicability": [ "tlp-clear", "tlp-green", @@ -4930,201 +3219,16 @@ "app_ensure_auth_is_set_up" ] }, - { - "Id": "CCC.SecMgmt.CN01.AR01", - "Description": "Attempt to use an outdated version of a secret after its rotation period\nhas passed and verify that access is denied.", - "Attributes": [ - { - "FamilyName": "Data Protection", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.SecMgmt.CN01 Enforce Automatic Secret Rotation", - "SubSection": "", - "SubSectionObjective": "Ensure that secrets are automatically rotated on a defined schedule to\nreduce the risk of secret compromise and unauthorized access.", - "Applicability": [ - "tlp-red", - "tlp-amber" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.TH01", - "CCC.TH14" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.DS-6" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-12", - "SC-28" - ] - } - ] - } - ], - "Checks": [ - "keyvault_key_rotation_enabled", - "storage_key_rotation_90_days" - ] - }, - { - "Id": "CCC.SecMgmt.CN02.AR01", - "Description": "Attempt to retrieve a secret from an unauthorized region and verify that access is denied.", - "Attributes": [ - { - "FamilyName": "Data Protection", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.SecMgmt.CN02 Enforce Secret Replication Policies", - "SubSection": "", - "SubSectionObjective": "Ensure that secrets are replicated only to authorized locations as per\norganizational data residency and compliance requirements.", - "Applicability": [ - "tlp-red", - "tlp-amber" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.TH03", - "CCC.TH04" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.DS-5" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-3", - "SC-7" - ] - } - ] - } - ], - "Checks": [ - "keyvault_private_endpoints", - "keyvault_access_only_through_private_endpoints", - "keyvault_rbac_enabled", - "keyvault_logging_enabled" - ] - }, - { - "Id": "CCC.SvlsComp.CN01.AR01", - "Description": "Attempt to access the serverless function over the public internet and verify that access is denied.", - "Attributes": [ - { - "FamilyName": "Network Security", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.SvlsComp.CN01 Enforce Use of Private Endpoints for Serverless Function", - "SubSection": "", - "SubSectionObjective": "Ensure that the serverless function is accessible only through a private endpoint,\nallowing it to communicate securely within a virtual private network and preventing\nunauthorized external access.", - "Applicability": [ - "tlp-red", - "tlp-amber" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-5" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-7", - "SC-8" - ] - } - ] - } - ], - "Checks": [ - "app_function_not_publicly_accessible", - "app_function_vnet_integration_enabled" - ] - }, - { - "Id": "CCC.SvlsComp.CN02.AR01", - "Description": "Send requests to invoke the function up to the allowed threshold and confirm they\nare successful; then send additional requests exceeding the threshold from the same\nentity and verify that they are denied.", - "Attributes": [ - { - "FamilyName": "Availability", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.SvlsComp.CN02 Implement Function Invocation Rate Limits", - "SubSection": "", - "SubSectionObjective": "Ensure that function invocation is limited to a specified threshold from any single entity,\npreventing resource exhaustion and denial of service attacks.", - "Applicability": [ - "tlp-red", - "tlp-amber" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.TH12" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.DS-4" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-5" - ] - } - ] - } - ], - "Checks": [ - "app_function_access_keys_configured", - "app_function_not_publicly_accessible", - "app_function_vnet_integration_enabled", - "app_function_identity_is_configured" - ] - }, { "Id": "CCC.VPC.CN01.AR01", - "Description": "When a subscription is created, the subscription MUST NOT\ncontain default network resources.", + "Description": "When a subscription is created, the subscription MUST NOT contain default network resources.", "Attributes": [ { "FamilyName": "Network Security", "FamilyDescription": "TODO: Describe this control family", "Section": "CCC.VPC.CN01 Restrict Default Network Creation", "SubSection": "", - "SubSectionObjective": "Restrict the automatic creation of default virtual networks and related\nresources during subscription initialization to avoid insecure default\nconfigurations and enforce custom network policies.", + "SubSectionObjective": "Restrict the automatic creation of default virtual networks and related resources during subscription initialization to avoid insecure default configurations and enforce custom network policies.", "Applicability": [ "tlp-amber", "tlp-red" @@ -5168,86 +3272,16 @@ ], "Checks": [] }, - { - "Id": "CCC.VPC.CN02.AR01", - "Description": "When a resource is created in a public subnet, that resource\nMUST NOT be assigned an external IP address by default.", - "Attributes": [ - { - "FamilyName": "Network Security", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.VPC.CN02 Limit Resource Creation in Public Subnet", - "SubSection": "", - "SubSectionObjective": "Restrict the creation of resources in the public subnet with\ndirect access to the internet to minimize attack surfaces.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.VPC.TH02" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-3" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "SEF-05" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.13.1.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-4" - ] - } - ] - } - ], - "Checks": [ - "aks_clusters_public_access_disabled", - "aks_clusters_created_with_private_nodes", - "network_http_internet_access_restricted", - "network_rdp_internet_access_restricted", - "network_ssh_internet_access_restricted", - "network_udp_internet_access_restricted", - "containerregistry_not_publicly_accessible", - "containerregistry_uses_private_link", - "keyvault_private_endpoints", - "keyvault_access_only_through_private_endpoints", - "cosmosdb_account_use_private_endpoints", - "cosmosdb_account_firewall_use_selected_networks", - "storage_ensure_private_endpoints_in_storage_accounts", - "storage_default_network_access_rule_is_denied", - "storage_blob_public_access_level_is_disabled", - "sqlserver_unrestricted_inbound_access", - "app_function_not_publicly_accessible" - ] - }, { "Id": "CCC.VPC.CN03.AR01", - "Description": "When a VPC peering connection is requested, the service MUST\nprevent connections from VPCs that are not explicitly\nallowed.", + "Description": "When a VPC peering connection is requested, the service MUST prevent connections from VPCs that are not explicitly allowed.", "Attributes": [ { "FamilyName": "Network Security", "FamilyDescription": "TODO: Describe this control family", "Section": "CCC.VPC.CN03 Restrict VPC Peering to Authorized Accounts", "SubSection": "", - "SubSectionObjective": "Ensure VPC peering connections are only established with explicitly\nauthorized destinations to limit network exposure and enforce boundary\ncontrols.", + "SubSectionObjective": "Ensure VPC peering connections are only established with explicitly authorized destinations to limit network exposure and enforce boundary controls.", "Applicability": [ "tlp-green", "tlp-amber", @@ -5294,14 +3328,14 @@ }, { "Id": "CCC.VPC.CN04.AR01", - "Description": "When any network traffic goes to or from an interface in the VPC,\nthe service MUST capture and log all relevant information.", + "Description": "When any network traffic goes to or from an interface in the VPC, the service MUST capture and log all relevant information.", "Attributes": [ { "FamilyName": "Network Security", "FamilyDescription": "TODO: Describe this control family", "Section": "CCC.VPC.CN04 Enforce VPC Flow Logs on VPCs", "SubSection": "", - "SubSectionObjective": "Ensure VPCs are configured with flow logs enabled to capture traffic\ninformation.", + "SubSectionObjective": "Ensure VPCs are configured with flow logs enabled to capture traffic information.", "Applicability": [ "tlp-amber", "tlp-red" @@ -5351,14 +3385,14 @@ }, { "Id": "CCC.Vector.CN01.AR01", - "Description": "When a vector embedding is submitted for indexing, the system MUST validate that it\nmatches expected schema, dimension, and format profiles.", + "Description": "When a vector embedding is submitted for indexing, the system MUST validate that it matches expected schema, dimension, and format profiles.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN01 Validate Embeddings Before Indexing", "SubSection": "", - "SubSectionObjective": "Ensure all incoming embeddings are structurally and statistically validated\nbefore indexing to prevent poisoning or corruption.", + "SubSectionObjective": "Ensure all incoming embeddings are structurally and statistically validated before indexing to prevent poisoning or corruption.", "Applicability": [ "tlp-clear", "tlp-green", @@ -5390,14 +3424,14 @@ }, { "Id": "CCC.Vector.CN02.AR01", - "Description": "When an index lifecycle event is triggered, the service MUST\nverify that the actor has explicit permissions for the operation type.", + "Description": "When an index lifecycle event is triggered, the service MUST verify that the actor has explicit permissions for the operation type.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN02 Enforce Role-Based Index Lifecycle Management", "SubSection": "", - "SubSectionObjective": "Restrict index lifecycle operations (create, delete, rollback) to privileged\nidentities using fine-grained access controls.", + "SubSectionObjective": "Restrict index lifecycle operations (create, delete, rollback) to privileged identities using fine-grained access controls.", "Applicability": [ "tlp-clear", "tlp-green", @@ -5435,14 +3469,14 @@ }, { "Id": "CCC.Vector.CN03.AR01", - "Description": "When a metadata filter is applied to a query, the service MUST\nverify the requester is authorized to access that field.", + "Description": "When a metadata filter is applied to a query, the service MUST verify the requester is authorized to access that field.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN03 Enforce Metadata-Level Access Controls", "SubSection": "", - "SubSectionObjective": "Apply access control policies to metadata fields used in filtering to\nprevent unauthorized exposure or inference.", + "SubSectionObjective": "Apply access control policies to metadata fields used in filtering to prevent unauthorized exposure or inference.", "Applicability": [ "tlp-amber", "tlp-red" @@ -5469,49 +3503,18 @@ ] } ], - "Checks": [ - "app_function_not_publicly_accessible", - "app_function_identity_is_configured", - "app_function_identity_without_admin_privileges", - "app_function_access_keys_configured", - "containerregistry_not_publicly_accessible", - "containerregistry_uses_private_link", - "containerregistry_admin_user_disabled", - "cosmosdb_account_firewall_use_selected_networks", - "cosmosdb_account_use_private_endpoints", - "cosmosdb_account_use_aad_and_rbac", - "keyvault_rbac_enabled", - "keyvault_private_endpoints", - "keyvault_access_only_through_private_endpoints", - "keyvault_logging_enabled", - "storage_blob_public_access_level_is_disabled", - "storage_default_network_access_rule_is_denied", - "storage_ensure_private_endpoints_in_storage_accounts", - "storage_account_key_access_disabled", - "storage_secure_transfer_required_is_enabled", - "storage_ensure_encryption_with_customer_managed_keys", - "storage_ensure_soft_delete_is_enabled", - "storage_ensure_file_shares_soft_delete_is_enabled", - "iam_role_user_access_admin_restricted", - "iam_custom_role_has_permissions_to_administer_resource_locks", - "network_http_internet_access_restricted", - "network_rdp_internet_access_restricted", - "network_ssh_internet_access_restricted", - "network_udp_internet_access_restricted", - "aks_clusters_public_access_disabled", - "aks_network_policy_enabled" - ] + "Checks": [] }, { "Id": "CCC.Vector.CN04.AR01", - "Description": "When ingestion exceeds pre-defined thresholds, the service MUST\nthrottle or reject excess vector write operations.", + "Description": "When ingestion exceeds pre-defined thresholds, the service MUST throttle or reject excess vector write operations.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN04 Enforce Ingestion Quotas and Throttling", "SubSection": "", - "SubSectionObjective": "Prevent ingestion-based DoS or index pollution by\nrate-limiting vector submissions and enforcing quotas.", + "SubSectionObjective": "Prevent ingestion-based DoS or index pollution by rate-limiting vector submissions and enforcing quotas.", "Applicability": [ "tlp-green", "tlp-amber", @@ -5541,14 +3544,14 @@ }, { "Id": "CCC.Vector.CN05.AR01", - "Description": "When a rollback is attempted, the system MUST log\nthe action and verify rollback authorization.", + "Description": "When a rollback is attempted, the system MUST log the action and verify rollback authorization.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN05 Enforce Index Versioning with Rollback Protection", "SubSection": "", - "SubSectionObjective": "Ensure vector indexes are versioned and that rollback\noperations are authorized and auditable.", + "SubSectionObjective": "Ensure vector indexes are versioned and that rollback operations are authorized and auditable.", "Applicability": [ "tlp-amber", "tlp-red" @@ -5578,14 +3581,14 @@ }, { "Id": "CCC.Vector.CN06.AR01", - "Description": "When an embedding is submitted, the service MUST validate\nthat its format and dimensionality match allowed profiles.", + "Description": "When an embedding is submitted, the service MUST validate that its format and dimensionality match allowed profiles.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN06 Enforce Dimensional and Format Constraints", "SubSection": "", - "SubSectionObjective": "Reject embeddings that do not conform to expected model\nspecifications (dimensions, format, etc).", + "SubSectionObjective": "Reject embeddings that do not conform to expected model specifications (dimensions, format, etc).", "Applicability": [ "tlp-clear", "tlp-green", @@ -5616,14 +3619,14 @@ }, { "Id": "CCC.Vector.CN07.AR01", - "Description": "When a search request is issued, clients MUST be allowed\nto declare their requirement for exact vs approximate results.", + "Description": "When a search request is issued, clients MUST be allowed to declare their requirement for exact vs approximate results.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN07 Support Explicit ANN vs. Exact Search Configuration", "SubSection": "", - "SubSectionObjective": "Provide clients with the option to enforce exact-match\n(non-ANN) search where search fidelity is critical.", + "SubSectionObjective": "Provide clients with the option to enforce exact-match (non-ANN) search where search fidelity is critical.", "Applicability": [ "tlp-amber", "tlp-red" @@ -5644,20 +3647,20 @@ }, { "Id": "CCC.Core.CN01.AR01", - "Description": "When a port is exposed for non-SSH network traffic, all traffic\nMUST include a TLS handshake AND be encrypted using TLS 1.3 or\nhigher.", + "Description": "When a port is exposed for non-SSH network traffic, all traffic MUST include a TLS handshake AND be encrypted using TLS 1.3 or higher.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN01 Encrypt Data for Transmission", "SubSection": "", - "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect\ndata integrity and confidentiality.", + "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect data integrity and confidentiality.", "Applicability": [ "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Most cloud services enable TLS 1.3 by default. Where it is not\nalready set, ensure that your services are configured or updated\naccordingly.\n", + "Recommendation": "Most cloud services enable TLS 1.3 by default. Where it is not already set, ensure that your services are configured or updated accordingly. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -5707,21 +3710,21 @@ }, { "Id": "CCC.Core.CN01.AR02", - "Description": "When a port is exposed for SSH network traffic, all traffic MUST\ninclude a SSH handshake AND be encrypted using SSHv2 or higher.", + "Description": "When a port is exposed for SSH network traffic, all traffic MUST include a SSH handshake AND be encrypted using SSHv2 or higher.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN01 Encrypt Data for Transmission", "SubSection": "", - "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect\ndata integrity and confidentiality.", + "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect data integrity and confidentiality.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Any time port 22 is exposed, ensure that it has a properly\nimplemented SSH server with SSHv2 enabled and configured with\nstrong ciphers.\n", + "Recommendation": "Any time port 22 is exposed, ensure that it has a properly implemented SSH server with SSHv2 enabled and configured with strong ciphers. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -5773,20 +3776,20 @@ }, { "Id": "CCC.Core.CN01.AR03", - "Description": "When the service receives unencrypted traffic, \nthen it MUST either block the request or automatically\nredirect it to the secure equivalent.", + "Description": "When the service receives unencrypted traffic, then it MUST either block the request or automatically redirect it to the secure equivalent.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN01 Encrypt Data for Transmission", "SubSection": "", - "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect\ndata integrity and confidentiality.", + "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect data integrity and confidentiality.", "Applicability": [ "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Review firewall, load balancer, and application configurations to\nensure insecure protocols such as HTTP, FTP, and Telnet are not\nexposed. Where possible, implement automatic redirection to secure\nprotocols such as HTTPS, SFTP, SSH, and regularly scan for\nprotocol drift.\n", + "Recommendation": "Review firewall, load balancer, and application configurations to ensure insecure protocols such as HTTP, FTP, and Telnet are not exposed. Where possible, implement automatic redirection to secure protocols such as HTTPS, SFTP, SSH, and regularly scan for protocol drift. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -5837,21 +3840,21 @@ }, { "Id": "CCC.Core.CN01.AR07", - "Description": "When a port is exposed, the service MUST ensure that the protocol\nand service officially assigned to that port number by the IANA\nService Name and Transport Protocol Port Number Registry, and no\nother, is run on that port.", + "Description": "When a port is exposed, the service MUST ensure that the protocol and service officially assigned to that port number by the IANA Service Name and Transport Protocol Port Number Registry, and no other, is run on that port.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN01 Encrypt Data for Transmission", "SubSection": "", - "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect\ndata integrity and confidentiality.", + "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect data integrity and confidentiality.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Reference the IANA Service Name and Transport Protocol Port Number\nRegistry for more information about correct protocol-to-port\nassignments. Avoid running non-standard services on well-known\nports.\n", + "Recommendation": "Reference the IANA Service Name and Transport Protocol Port Number Registry for more information about correct protocol-to-port assignments. Avoid running non-standard services on well-known ports. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -5904,19 +3907,19 @@ }, { "Id": "CCC.Core.CN01.AR08", - "Description": "When a service transmits data using TLS, mutual TLS (mTLS) MUST be\nimplemented to require both client and server certificate\nauthentication for all connections.", + "Description": "When a service transmits data using TLS, mutual TLS (mTLS) MUST be implemented to require both client and server certificate authentication for all connections.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN01 Encrypt Data for Transmission", "SubSection": "", - "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect\ndata integrity and confidentiality.", + "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect data integrity and confidentiality.", "Applicability": [ "tlp-amber", "tlp-red" ], - "Recommendation": "Configure mTLS for all endpoints that process or transmit\nsensitive data. Ensure both client and server certificates are\nvalidated and managed securely. Regularly review certificate\nauthorities and automate certificate rotation where possible.\n", + "Recommendation": "Configure mTLS for all endpoints that process or transmit sensitive data. Ensure both client and server certificates are validated and managed securely. Regularly review certificate authorities and automate certificate rotation where possible. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -5965,21 +3968,21 @@ }, { "Id": "CCC.Core.CN13.AR01", - "Description": "When a port is exposed that uses certificate-based encryption,\nthe service MUST only use valid, unexpired certificates issued by\na trusted certificate authority.", + "Description": "When a port is exposed that uses certificate-based encryption, the service MUST only use valid, unexpired certificates issued by a trusted certificate authority.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN13 Minimize Lifetime of Encryption and Authentication Certificates", "SubSection": "", - "SubSectionObjective": "Ensure that encryption and authentication certificates have a limited\nlifetime to reduce the risk of compromise and ensure the use of\nup-to-date security practices.", + "SubSectionObjective": "Ensure that encryption and authentication certificates have a limited lifetime to reduce the risk of compromise and ensure the use of up-to-date security practices.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Track certificate expiration dates and automate certificate\nrenewal where possible. Use certificate management tools to ensure\nonly certificates from trusted authorities are deployed.\n", + "Recommendation": "Track certificate expiration dates and automate certificate renewal where possible. Use certificate management tools to ensure only certificates from trusted authorities are deployed. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6003,18 +4006,18 @@ }, { "Id": "CCC.Core.CN13.AR02", - "Description": "When a port is exposed that uses certificate-based encryption,\nthe service MUST rotate active certificates within 180 days of\nissuance.", + "Description": "When a port is exposed that uses certificate-based encryption, the service MUST rotate active certificates within 180 days of issuance.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN13 Minimize Lifetime of Encryption and Authentication Certificates", "SubSection": "", - "SubSectionObjective": "Ensure that encryption and authentication certificates have a limited\nlifetime to reduce the risk of compromise and ensure the use of\nup-to-date security practices.", + "SubSectionObjective": "Ensure that encryption and authentication certificates have a limited lifetime to reduce the risk of compromise and ensure the use of up-to-date security practices.", "Applicability": [ "tlp-amber" ], - "Recommendation": "Track certificate expiration dates and automate certificate\nrenewal where possible. Use certificate management tools to ensure\nonly certificates from trusted authorities are deployed.\n", + "Recommendation": "Track certificate expiration dates and automate certificate renewal where possible. Use certificate management tools to ensure only certificates from trusted authorities are deployed. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6037,18 +4040,18 @@ }, { "Id": "CCC.Core.CN13.AR03", - "Description": "When a port is exposed that uses certificate-based encryption,\nthe service MUST rotate active certificates within 90 days of\nissuance.", + "Description": "When a port is exposed that uses certificate-based encryption, the service MUST rotate active certificates within 90 days of issuance.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN13 Minimize Lifetime of Encryption and Authentication Certificates", "SubSection": "", - "SubSectionObjective": "Ensure that encryption and authentication certificates have a limited\nlifetime to reduce the risk of compromise and ensure the use of\nup-to-date security practices.", + "SubSectionObjective": "Ensure that encryption and authentication certificates have a limited lifetime to reduce the risk of compromise and ensure the use of up-to-date security practices.", "Applicability": [ "tlp-red" ], - "Recommendation": "Track certificate expiration dates and automate certificate\nrenewal where possible. Use certificate management tools to ensure\nonly certificates from trusted authorities are deployed.\n", + "Recommendation": "Track certificate expiration dates and automate certificate renewal where possible. Use certificate management tools to ensure only certificates from trusted authorities are deployed. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6068,21 +4071,21 @@ }, { "Id": "CCC.Core.CN06.AR01", - "Description": "When the service is running, its region and availability zone MUST\nbe included in a list of explicitly trusted or approved locations\nwithin the trust perimeter.", + "Description": "When the service is running, its region and availability zone MUST be included in a list of explicitly trusted or approved locations within the trust perimeter.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN06 Restrict Deployments to Trust Perimeter", "SubSection": "", - "SubSectionObjective": "Ensure that the service and its child resources are only deployed on\ninfrastructure in locations that are explicitly included within a\ndefined trust perimeter.", + "SubSectionObjective": "Ensure that the service and its child resources are only deployed on infrastructure in locations that are explicitly included within a defined trust perimeter.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Maintain an up-to-date list of trusted and approved regions based\non organizational policies. Validate the service's deployment\nlocation is included in this list.\n", + "Recommendation": "Maintain an up-to-date list of trusted and approved regions based on organizational policies. Validate the service's deployment location is included in this list. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6137,21 +4140,21 @@ }, { "Id": "CCC.Core.CN06.AR02", - "Description": "When a child resource is deployed, its region and availability\nzone MUST be included in a list of explicitly trusted or approved\nlocations within the trust perimeter.", + "Description": "When a child resource is deployed, its region and availability zone MUST be included in a list of explicitly trusted or approved locations within the trust perimeter.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN06 Restrict Deployments to Trust Perimeter", "SubSection": "", - "SubSectionObjective": "Ensure that the service and its child resources are only deployed on\ninfrastructure in locations that are explicitly included within a\ndefined trust perimeter.", + "SubSectionObjective": "Ensure that the service and its child resources are only deployed on infrastructure in locations that are explicitly included within a defined trust perimeter.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Maintain an up-to-date list of trusted and approved regions based\non organizational policies. Validate that child resources can only\nbe deployed to locations included in this list.\n", + "Recommendation": "Maintain an up-to-date list of trusted and approved regions based on organizational policies. Validate that child resources can only be deployed to locations included in this list. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6194,20 +4197,20 @@ }, { "Id": "CCC.Core.CN08.AR01", - "Description": "When data is created or modified, the data MUST have a complete\nand recoverable duplicate that is stored in a physically separate\ndata center.", + "Description": "When data is created or modified, the data MUST have a complete and recoverable duplicate that is stored in a physically separate data center.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN08 Replicate Data to Multiple Locations", "SubSection": "", - "SubSectionObjective": "Ensure that data is replicated across multiple physical locations to\nprotect against data loss due to hardware failures, natural disasters,\nor other catastrophic events.", + "SubSectionObjective": "Ensure that data is replicated across multiple physical locations to protect against data loss due to hardware failures, natural disasters, or other catastrophic events.", "Applicability": [ "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Implement automated data replication processes to ensure that\ndata is consistently duplicated in another region or availability\nzone. Regularly test data recovery from the replicated location to\nensure integrity and availability.\n", + "Recommendation": "Implement automated data replication processes to ensure that data is consistently duplicated in another region or availability zone. Regularly test data recovery from the replicated location to ensure integrity and availability. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6249,14 +4252,14 @@ }, { "Id": "CCC.Core.CN08.AR02", - "Description": "When data is replicated into a second location, the service MUST\nbe able to accurately represent the replication locations,\nreplication status, and data synchronization status.", + "Description": "When data is replicated into a second location, the service MUST be able to accurately represent the replication locations, replication status, and data synchronization status.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN08 Replicate Data to Multiple Locations", "SubSection": "", - "SubSectionObjective": "Ensure that data is replicated across multiple physical locations to\nprotect against data loss due to hardware failures, natural disasters,\nor other catastrophic events.", + "SubSectionObjective": "Ensure that data is replicated across multiple physical locations to protect against data loss due to hardware failures, natural disasters, or other catastrophic events.", "Applicability": [ "tlp-green", "tlp-amber", @@ -6302,14 +4305,14 @@ }, { "Id": "CCC.Core.CN09.AR01", - "Description": "When the service is operational, its logs and any child resource\nlogs MUST NOT be accessible from the resource they record access\nto.", + "Description": "When the service is operational, its logs and any child resource logs MUST NOT be accessible from the resource they record access to.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN09 Ensure Integrity of Access Logs", "SubSection": "", - "SubSectionObjective": "Ensure that access logs are always recorded to an external location\nthat cannot be manipulated from the context of the service(s) it\ncontains logs for.", + "SubSectionObjective": "Ensure that access logs are always recorded to an external location that cannot be manipulated from the context of the service(s) it contains logs for.", "Applicability": [ "tlp-clear", "tlp-green", @@ -6360,21 +4363,21 @@ }, { "Id": "CCC.Core.CN09.AR02", - "Description": "When the service is operational, disabling the logs for the service\nor its child resources MUST NOT be possible without also disabling\nthe corresponding resource.", + "Description": "When the service is operational, disabling the logs for the service or its child resources MUST NOT be possible without also disabling the corresponding resource.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN09 Ensure Integrity of Access Logs", "SubSection": "", - "SubSectionObjective": "Ensure that access logs are always recorded to an external location\nthat cannot be manipulated from the context of the service(s) it\ncontains logs for.", + "SubSectionObjective": "Ensure that access logs are always recorded to an external location that cannot be manipulated from the context of the service(s) it contains logs for.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "No normal business operations should disable\nlogs, as this could indicate an attempt to cover up unauthorized\naccess. Ensure that logging mechanisms are tightly integrated with\nservice operations, so that logging cannot be disabled without\nstopping the service itself.\n", + "Recommendation": "No normal business operations should disable logs, as this could indicate an attempt to cover up unauthorized access. Ensure that logging mechanisms are tightly integrated with service operations, so that logging cannot be disabled without stopping the service itself. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6420,19 +4423,19 @@ }, { "Id": "CCC.Core.CN09.AR03", - "Description": "When the service is operational, any attempt to redirect logs for\nthe service or its child resources MUST NOT be possible without\nhalting operation of the corresponding resource and publishing\ncorresponding events to monitored channels.", + "Description": "When the service is operational, any attempt to redirect logs for the service or its child resources MUST NOT be possible without halting operation of the corresponding resource and publishing corresponding events to monitored channels.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN09 Ensure Integrity of Access Logs", "SubSection": "", - "SubSectionObjective": "Ensure that access logs are always recorded to an external location\nthat cannot be manipulated from the context of the service(s) it\ncontains logs for.", + "SubSectionObjective": "Ensure that access logs are always recorded to an external location that cannot be manipulated from the context of the service(s) it contains logs for.", "Applicability": [ "tlp-amber", "tlp-red" ], - "Recommendation": "No normal business operations should result in the redirection of\nlogs, as this could indicate an attempt to cover up unauthorized\naccess. Ensure that logging configurations are immutable during\nservice operation so that any changes require stopping the service\nand publishing corresponding events to monitored channels.\n", + "Recommendation": "No normal business operations should result in the redirection of logs, as this could indicate an attempt to cover up unauthorized access. Ensure that logging configurations are immutable during service operation so that any changes require stopping the service and publishing corresponding events to monitored channels. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6479,14 +4482,14 @@ }, { "Id": "CCC.Core.CN10.AR01", - "Description": "When data is replicated, the service MUST ensure that replication\nonly occurs to destinations that are explicitly included within\nthe defined trust perimeter.", + "Description": "When data is replicated, the service MUST ensure that replication only occurs to destinations that are explicitly included within the defined trust perimeter.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN10 Restrict Data Replication to Trust Perimeter", "SubSection": "", - "SubSectionObjective": "Ensure that data is only replicated on infrastructure in locations\nthat are explicitly included within a defined trust perimeter.", + "SubSectionObjective": "Ensure that data is only replicated on infrastructure in locations that are explicitly included within a defined trust perimeter.", "Applicability": [ "tlp-green", "tlp-amber", @@ -6535,14 +4538,14 @@ }, { "Id": "CCC.Core.CN02.AR01", - "Description": "When data is stored, it MUST be encrypted using the latest\nindustry-standard encryption methods.", + "Description": "When data is stored, it MUST be encrypted using the latest industry-standard encryption methods.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN02 Encrypt Data for Storage", "SubSection": "", - "SubSectionObjective": "Ensure that all data stored is encrypted at rest using strong\nencryption algorithms.", + "SubSectionObjective": "Ensure that all data stored is encrypted at rest using strong encryption algorithms.", "Applicability": [ "tlp-green", "tlp-amber", @@ -6596,14 +4599,14 @@ }, { "Id": "CCC.Core.CN11.AR01", - "Description": "When encryption keys are used, the service MUST verify that\nall encryption keys use the latest industry-standard cryptographic\nalgorithms.", + "Description": "When encryption keys are used, the service MUST verify that all encryption keys use the latest industry-standard cryptographic algorithms.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN11 Protect Encryption Keys", "SubSection": "", - "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing\nthe use of approved algorithms, regular key rotation, and\ncustomer-managed encryption keys (CMEKs).", + "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).", "Applicability": [ "tlp-amber", "tlp-red" @@ -6664,14 +4667,14 @@ }, { "Id": "CCC.Core.CN11.AR02", - "Description": "When encryption keys are used, the service MUST rotate active keys\nwithin 180 days of issuance.", + "Description": "When encryption keys are used, the service MUST rotate active keys within 180 days of issuance.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN11 Protect Encryption Keys", "SubSection": "", - "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing\nthe use of approved algorithms, regular key rotation, and\ncustomer-managed encryption keys (CMEKs).", + "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).", "Applicability": [ "tlp-amber" ], @@ -6723,14 +4726,14 @@ }, { "Id": "CCC.Core.CN11.AR03", - "Description": "When encrypting data, the service MUST verify that\ncustomer-managed encryption keys (CMEKs) are used.", + "Description": "When encrypting data, the service MUST verify that customer-managed encryption keys (CMEKs) are used.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "", "SubSection": "CCC.Core.CN11 Protect Encryption Keys", - "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing\nthe use of approved algorithms, regular key rotation, and\ncustomer-managed encryption keys (CMEKs).", + "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).", "Applicability": [ "tlp-amber", "tlp-red" @@ -6786,14 +4789,14 @@ }, { "Id": "CCC.Core.CN11.AR04", - "Description": "When encryption keys are accessed, the service MUST verify that\naccess to encryption keys is restricted to authorized personnel\nand services, following the principle of least privilege.", + "Description": "When encryption keys are accessed, the service MUST verify that access to encryption keys is restricted to authorized personnel and services, following the principle of least privilege.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN11 Protect Encryption Keys", "SubSection": "", - "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing\nthe use of approved algorithms, regular key rotation, and\ncustomer-managed encryption keys (CMEKs).", + "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).", "Applicability": [ "tlp-clear", "tlp-green", @@ -6855,14 +4858,14 @@ }, { "Id": "CCC.Core.CN11.AR05", - "Description": "When encryption keys are used, the service MUST rotate active keys\nwithin 365 days of issuance.", + "Description": "When encryption keys are used, the service MUST rotate active keys within 365 days of issuance.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN11 Protect Encryption Keys", "SubSection": "", - "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing\nthe use of approved algorithms, regular key rotation, and\ncustomer-managed encryption keys (CMEKs).", + "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).", "Applicability": [ "tlp-clear", "tlp-green" @@ -6919,14 +4922,14 @@ }, { "Id": "CCC.Core.CN11.AR06", - "Description": "When encryption keys are used, the service MUST rotate active keys\nwithin 90 days of issuance.", + "Description": "When encryption keys are used, the service MUST rotate active keys within 90 days of issuance.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN11 Protect Encryption Keys", "SubSection": "", - "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing\nthe use of approved algorithms, regular key rotation, and\ncustomer-managed encryption keys (CMEKs).", + "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).", "Applicability": [ "tlp-red" ], @@ -6976,21 +4979,21 @@ }, { "Id": "CCC.Core.CN14.AR01", - "Description": "When backups are created for disaster recovery purposes, the\nstorage mechanism MUST NOT allow modification or deletion\nwithin 30 days of creation.", + "Description": "When backups are created for disaster recovery purposes, the storage mechanism MUST NOT allow modification or deletion within 30 days of creation.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN14 Maintain Recent Backups", "SubSection": "", - "SubSectionObjective": "Ensure that all backups used for disaster recovery are recent and\nsubject to a retention policy that limits deletion.", + "SubSectionObjective": "Ensure that all backups used for disaster recovery are recent and subject to a retention policy that limits deletion.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Use immutable storage solutions where possible. Implement backup\nretention policies that enforce a minimum retention period of 30\ndays.\n", + "Recommendation": "Use immutable storage solutions where possible. Implement backup retention policies that enforce a minimum retention period of 30 days. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -7009,20 +5012,20 @@ }, { "Id": "CCC.Core.CN14.AR02", - "Description": "When backups are created for disaster recovery purposes, the\nmost recent backup MUST have a creation date within the past\n30 days.", + "Description": "When backups are created for disaster recovery purposes, the most recent backup MUST have a creation date within the past 30 days.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN14 Maintain Recent Backups", "SubSection": "", - "SubSectionObjective": "Ensure that all backups used for disaster recovery are recent and\nsubject to a retention policy that limits deletion.", + "SubSectionObjective": "Ensure that all backups used for disaster recovery are recent and subject to a retention policy that limits deletion.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber" ], - "Recommendation": "Implement automated backup processes to ensure that backups are\ncreated regularly. Monitor backup schedules and verify that the\nmost recent backup creation date is within the last 30 days.\n", + "Recommendation": "Implement automated backup processes to ensure that backups are created regularly. Monitor backup schedules and verify that the most recent backup creation date is within the last 30 days. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -7041,18 +5044,18 @@ }, { "Id": "CCC.Core.CN14.AR02", - "Description": "When backups are created for disaster recovery purposes, the\nmost recent backup MUST have a creation date within the past\n14 days.", + "Description": "When backups are created for disaster recovery purposes, the most recent backup MUST have a creation date within the past 14 days.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN14 Maintain Recent Backups", "SubSection": "", - "SubSectionObjective": "Ensure that all backups used for disaster recovery are recent and\nsubject to a retention policy that limits deletion.", + "SubSectionObjective": "Ensure that all backups used for disaster recovery are recent and subject to a retention policy that limits deletion.", "Applicability": [ "tlp-red" ], - "Recommendation": "Implement automated backup processes to ensure that backups are\ncreated regularly. Monitor backup schedules and verify that the\nmost recent backup creation date is within the last 14 days.\n", + "Recommendation": "Implement automated backup processes to ensure that backups are created regularly. Monitor backup schedules and verify that the most recent backup creation date is within the last 14 days. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -7071,14 +5074,14 @@ }, { "Id": "CCC.Core.CN03.AR01", - "Description": "When an entity attempts to modify the service through a user\ninterface, the authentication process MUST require multiple\nidentifying factors for authentication.", + "Description": "When an entity attempts to modify the service through a user interface, the authentication process MUST require multiple identifying factors for authentication.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN03 Implement Multi-factor Authentication (MFA) for Access", "SubSection": "", - "SubSectionObjective": "Ensure that all sensitive activities require two or more identity\nfactors during authentication to prevent unauthorized access.", + "SubSectionObjective": "Ensure that all sensitive activities require two or more identity factors during authentication to prevent unauthorized access.", "Applicability": [ "tlp-clear", "tlp-green", @@ -7139,14 +5142,14 @@ }, { "Id": "CCC.Core.CN03.AR02", - "Description": "When an entity attempts to modify the service through an API\nendpoint, the authentication process MUST require a credential\nsuch as an API key or token AND originate from within the trust\nperimeter.", + "Description": "When an entity attempts to modify the service through an API endpoint, the authentication process MUST require a credential such as an API key or token AND originate from within the trust perimeter.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN03 Implement Multi-factor Authentication (MFA) for Access", "SubSection": "", - "SubSectionObjective": "Ensure that all sensitive activities require two or more identity\nfactors during authentication to prevent unauthorized access.", + "SubSectionObjective": "Ensure that all sensitive activities require two or more identity factors during authentication to prevent unauthorized access.", "Applicability": [ "tlp-clear", "tlp-green", @@ -7206,14 +5209,14 @@ }, { "Id": "CCC.Core.CN03.AR03", - "Description": "When an entity attempts to view information on the service through\na user interface, the authentication process MUST require multiple\nidentifying factors from the user.", + "Description": "When an entity attempts to view information on the service through a user interface, the authentication process MUST require multiple identifying factors from the user.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN03 Implement Multi-factor Authentication (MFA) for Access", "SubSection": "", - "SubSectionObjective": "Ensure that all sensitive activities require two or more identity\nfactors during authentication to prevent unauthorized access.", + "SubSectionObjective": "Ensure that all sensitive activities require two or more identity factors during authentication to prevent unauthorized access.", "Applicability": [ "tlp-amber", "tlp-red" @@ -7271,14 +5274,14 @@ }, { "Id": "CCC.Core.CN03.AR04", - "Description": "When an entity attempts to view information on the service through\nan API endpoint, the authentication process MUST require a\ncredential such as an API key or token AND originate from within\nthe trust perimeter.", + "Description": "When an entity attempts to view information on the service through an API endpoint, the authentication process MUST require a credential such as an API key or token AND originate from within the trust perimeter.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN03 Implement Multi-factor Authentication (MFA) for Access", "SubSection": "", - "SubSectionObjective": "Ensure that all sensitive activities require two or more identity\nfactors during authentication to prevent unauthorized access.", + "SubSectionObjective": "Ensure that all sensitive activities require two or more identity factors during authentication to prevent unauthorized access.", "Applicability": [ "tlp-amber", "tlp-red" @@ -7336,14 +5339,14 @@ }, { "Id": "CCC.Core.CN05.AR01", - "Description": "When an attempt is made to modify data on the service or a child\nresource, the service MUST block requests from unauthorized\nentities.", + "Description": "When an attempt is made to modify data on the service or a child resource, the service MUST block requests from unauthorized entities.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN05 Prevent Access from Untrusted Entities", "SubSection": "", - "SubSectionObjective": "Ensure that secure access controls enforce the principle of least\nprivilege to restrict access to authorized entities from explicitly\ntrusted sources only.", + "SubSectionObjective": "Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.", "Applicability": [ "tlp-clear", "tlp-green", @@ -7420,14 +5423,14 @@ }, { "Id": "CCC.Core.CN05.AR02", - "Description": "When administrative access or configuration change is attempted on\nthe service or a child resource, the service MUST refuse requests\nfrom unauthorized entities.", + "Description": "When administrative access or configuration change is attempted on the service or a child resource, the service MUST refuse requests from unauthorized entities.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN05 Prevent Access from Untrusted Entities", "SubSection": "", - "SubSectionObjective": "Ensure that secure access controls enforce the principle of least\nprivilege to restrict access to authorized entities from explicitly\ntrusted sources only.", + "SubSectionObjective": "Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.", "Applicability": [ "tlp-clear", "tlp-green", @@ -7512,14 +5515,14 @@ }, { "Id": "CCC.Core.CN05.AR03", - "Description": "When administrative access or configuration change is attempted on\nthe service or a child resource in a multi-tenant environment, the\nservice MUST refuse requests across tenant boundaries unless the\norigin is explicitly included in a pre-approved allowlist.", + "Description": "When administrative access or configuration change is attempted on the service or a child resource in a multi-tenant environment, the service MUST refuse requests across tenant boundaries unless the origin is explicitly included in a pre-approved allowlist.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN05 Prevent Access from Untrusted Entities", "SubSection": "", - "SubSectionObjective": "Ensure that secure access controls enforce the principle of least\nprivilege to restrict access to authorized entities from explicitly\ntrusted sources only.", + "SubSectionObjective": "Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.", "Applicability": [ "tlp-clear", "tlp-green", @@ -7594,14 +5597,14 @@ }, { "Id": "CCC.Core.CN05.AR04", - "Description": "When data is requested from outside the trust perimeter, the\nservice MUST refuse requests from unauthorized entities.", + "Description": "When data is requested from outside the trust perimeter, the service MUST refuse requests from unauthorized entities.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "", "SubSection": "CCC.Core.CN05 Prevent Access from Untrusted Entities", - "SubSectionObjective": "Ensure that secure access controls enforce the principle of least\nprivilege to restrict access to authorized entities from explicitly\ntrusted sources only.", + "SubSectionObjective": "Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.", "Applicability": [ "tlp-amber", "tlp-red" @@ -7688,14 +5691,14 @@ }, { "Id": "CCC.Core.CN05.AR05", - "Description": "When any request is made from outside the trust perimeter,\nthe service MUST NOT provide any response that may indicate the\nservice exists.", + "Description": "When any request is made from outside the trust perimeter, the service MUST NOT provide any response that may indicate the service exists.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN05 Prevent Access from Untrusted Entities", "SubSection": "", - "SubSectionObjective": "Ensure that secure access controls enforce the principle of least\nprivilege to restrict access to authorized entities from explicitly\ntrusted sources only.", + "SubSectionObjective": "Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.", "Applicability": [ "tlp-red" ], @@ -7774,14 +5777,14 @@ }, { "Id": "CCC.Core.CN05.AR06", - "Description": "When any request is made to the service or a child resource, the\nservice MUST refuse requests from unauthorized entities.", + "Description": "When any request is made to the service or a child resource, the service MUST refuse requests from unauthorized entities.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN05 Prevent Access from Untrusted Entities", "SubSection": "", - "SubSectionObjective": "Ensure that secure access controls enforce the principle of least\nprivilege to restrict access to authorized entities from explicitly\ntrusted sources only.", + "SubSectionObjective": "Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.", "Applicability": [ "tlp-green", "tlp-amber", @@ -7850,14 +5853,14 @@ }, { "Id": "CCC.Core.CN04.AR01", - "Description": "When administrative access or configuration change is attempted on\nthe service or a child resource, the service MUST log the client\nidentity, time, and result of the attempt.", + "Description": "When administrative access or configuration change is attempted on the service or a child resource, the service MUST log the client identity, time, and result of the attempt.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "The Logging & Monitoring control family ensures that access,\nchanges, and security-relevant events are captured, monitored,\nand alerted on in order to provide visibility, support\nincident response, and meet compliance requirements.\n", + "FamilyDescription": "The Logging & Monitoring control family ensures that access, changes, and security-relevant events are captured, monitored, and alerted on in order to provide visibility, support incident response, and meet compliance requirements. ", "Section": "CCC.Core.CN04 Log All Access and Changes", "SubSection": "", - "SubSectionObjective": "Ensure that all access attempts are logged to maintain a detailed\naudit trail for security and compliance purposes.", + "SubSectionObjective": "Ensure that all access attempts are logged to maintain a detailed audit trail for security and compliance purposes.", "Applicability": [ "tlp-clear", "tlp-green", @@ -7916,14 +5919,14 @@ }, { "Id": "CCC.Core.CN04.AR02", - "Description": "When any attempt is made to modify data on the service or a child\nresource, the service MUST log the client identity, time, and\nresult of the attempt.", + "Description": "When any attempt is made to modify data on the service or a child resource, the service MUST log the client identity, time, and result of the attempt.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "The Logging & Monitoring control family ensures that access,\nchanges, and security-relevant events are captured, monitored,\nand alerted on in order to provide visibility, support\nincident response, and meet compliance requirements.\n", + "FamilyDescription": "The Logging & Monitoring control family ensures that access, changes, and security-relevant events are captured, monitored, and alerted on in order to provide visibility, support incident response, and meet compliance requirements. ", "Section": "CCC.Core.CN04 Log All Access and Changes", "SubSection": "", - "SubSectionObjective": "Ensure that all access attempts are logged to maintain a detailed\naudit trail for security and compliance purposes.", + "SubSectionObjective": "Ensure that all access attempts are logged to maintain a detailed audit trail for security and compliance purposes.", "Applicability": [ "tlp-amber", "tlp-red" @@ -7972,14 +5975,14 @@ }, { "Id": "CCC.Core.CN04.AR03", - "Description": "When any attempt is made to read data on the service or a child\nresource, the service MUST log the client identity, time, and\nresult of the attempt.", + "Description": "When any attempt is made to read data on the service or a child resource, the service MUST log the client identity, time, and result of the attempt.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "The Logging & Monitoring control family ensures that access,\nchanges, and security-relevant events are captured, monitored,\nand alerted on in order to provide visibility, support\nincident response, and meet compliance requirements.\n", + "FamilyDescription": "The Logging & Monitoring control family ensures that access, changes, and security-relevant events are captured, monitored, and alerted on in order to provide visibility, support incident response, and meet compliance requirements. ", "Section": "CCC.Core.CN04 Log All Access and Changes", "SubSection": "", - "SubSectionObjective": "Ensure that all access attempts are logged to maintain a detailed\naudit trail for security and compliance purposes.", + "SubSectionObjective": "Ensure that all access attempts are logged to maintain a detailed audit trail for security and compliance purposes.", "Applicability": [ "tlp-red" ], @@ -8028,19 +6031,19 @@ }, { "Id": "CCC.Core.CN07.AR01", - "Description": "When enumeration activities are detected, the service MUST publish\nan event to a monitored channel which includes the client\nidentity, time, and nature of the activity.", + "Description": "When enumeration activities are detected, the service MUST publish an event to a monitored channel which includes the client identity, time, and nature of the activity.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "The Logging & Monitoring control family ensures that access,\nchanges, and security-relevant events are captured, monitored,\nand alerted on in order to provide visibility, support\nincident response, and meet compliance requirements.\n", + "FamilyDescription": "The Logging & Monitoring control family ensures that access, changes, and security-relevant events are captured, monitored, and alerted on in order to provide visibility, support incident response, and meet compliance requirements. ", "Section": "CCC.Core.CN07 Alert on Unusual Enumeration Activity", "SubSection": "", - "SubSectionObjective": "Ensure that logs and associated alerts are generated when\nunusual enumeration activity is detected that may indicate\nreconnaissance activities.", + "SubSectionObjective": "Ensure that logs and associated alerts are generated when unusual enumeration activity is detected that may indicate reconnaissance activities.", "Applicability": [ "tlp-amber", "tlp-red" ], - "Recommendation": "Implement event publication mechanisms and alerts for patterns\nindicative of enumeration activities, such as repeated access\nattempts, requests, or liveness probes. Configure alerts to notify\nsecurity teams of any activities that merit further investigation.\n", + "Recommendation": "Implement event publication mechanisms and alerts for patterns indicative of enumeration activities, such as repeated access attempts, requests, or liveness probes. Configure alerts to notify security teams of any activities that merit further investigation. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -8078,21 +6081,21 @@ }, { "Id": "CCC.Core.CN07.AR02", - "Description": "When enumeration activities are detected, the service MUST log the\nclient identity, time, and nature of the activity.", + "Description": "When enumeration activities are detected, the service MUST log the client identity, time, and nature of the activity.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "The Logging & Monitoring control family ensures that access,\nchanges, and security-relevant events are captured, monitored,\nand alerted on in order to provide visibility, support\nincident response, and meet compliance requirements.\n", + "FamilyDescription": "The Logging & Monitoring control family ensures that access, changes, and security-relevant events are captured, monitored, and alerted on in order to provide visibility, support incident response, and meet compliance requirements. ", "Section": "CCC.Core.CN07 Alert on Unusual Enumeration Activity", "SubSection": "", - "SubSectionObjective": "Ensure that logs and associated alerts are generated when\nunusual enumeration activity is detected that may indicate\nreconnaissance activities.", + "SubSectionObjective": "Ensure that logs and associated alerts are generated when unusual enumeration activity is detected that may indicate reconnaissance activities.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Implement logging mechanisms to capture details of enumeration\nactivities, including client identity, timestamps, and activity\nnature. Retain logs according to organizational policies, and\noccasionally review them for patterns that may indicate\nreconnaissance activities.\n", + "Recommendation": "Implement logging mechanisms to capture details of enumeration activities, including client identity, timestamps, and activity nature. Retain logs according to organizational policies, and occasionally review them for patterns that may indicate reconnaissance activities. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", diff --git a/prowler/compliance/gcp/ccc_gcp.json b/prowler/compliance/gcp/ccc_gcp.json index 5c780dcbee..e3060646c5 100644 --- a/prowler/compliance/gcp/ccc_gcp.json +++ b/prowler/compliance/gcp/ccc_gcp.json @@ -6,19 +6,19 @@ "Description": "Common Cloud Controls Catalog (CCC) for GCP", "Requirements": [ { - "Id": "CCC.AuditLog.C01.TR01", + "Id": "CCC.AuditLog.CN01.AR01", "Description": "When the signature validation process is performed, then it MUST detect any modification of data.", "Attributes": [ { "FamilyName": "Integrity", "FamilyDescription": "Controls designed to protected the integrity of Audit Log data.", - "Section": "CCC.AuditLog.C01 Implement Digital Signatures With Hash Chaining", + "Section": "CCC.AuditLog.CN01 Implement Digital Signatures With Hash Chaining", "SubSection": "", - "SubSectionObjective": "Digital signatures allows for external verification of log data tampering and\nhash chaining allows for deleted log files to be detected.", + "SubSectionObjective": "Digital signatures allows for external verification of log data tampering and hash chaining allows for deleted log files to be detected.", "Applicability": [ "tlp-red" ], - "Recommendation": "Ensure hash of data is included in digital signature.\n", + "Recommendation": "Ensure hash of data is included in digital signature. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -52,19 +52,19 @@ ] }, { - "Id": "CCC.AuditLog.C01.TR02", + "Id": "CCC.AuditLog.CN01.AR02", "Description": "When the signature validation process is performed, then it MUST detect any missing (deleted) log file.", "Attributes": [ { "FamilyName": "Integrity", "FamilyDescription": "Controls designed to protected the integrity of Audit Log data.", - "Section": "CCC.AuditLog.C01 Implement Digital Signatures With Hash Chaining", + "Section": "CCC.AuditLog.CN01 Implement Digital Signatures With Hash Chaining", "SubSection": "", - "SubSectionObjective": "Digital signatures allows for external verification of log data tampering and\nhash chaining allows for deleted log files to be detected.", + "SubSectionObjective": "Digital signatures allows for external verification of log data tampering and hash chaining allows for deleted log files to be detected.", "Applicability": [ "tlp-red" ], - "Recommendation": "Ensure verification process includes a chained hash function.\n", + "Recommendation": "Ensure verification process includes a chained hash function. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -97,15 +97,15 @@ ] }, { - "Id": "CCC.AuditLog.C02.TR01", - "Description": "When a manual action is performed to generate each audit log type,\nthen the corresponding audit log type MUST be generated and recorded.", + "Id": "CCC.AuditLog.CN02.AR01", + "Description": "When a manual action is performed to generate each audit log type, then the corresponding audit log type MUST be generated and recorded.", "Attributes": [ { "FamilyName": "Integrity", "FamilyDescription": "Controls designed to protected the integrity of Audit Log data.", - "Section": "CCC.AuditLog.C02 Enable And Validate All Audit Log Types", + "Section": "CCC.AuditLog.CN02 Enable And Validate All Audit Log Types", "SubSection": "", - "SubSectionObjective": "Review audit log configuration and ensure that all audit log types\nare being generated and replicated to configured sinks", + "SubSectionObjective": "Review audit log configuration and ensure that all audit log types are being generated and replicated to configured sinks", "Applicability": [ "tlp-red", "tlp-amber" @@ -151,20 +151,20 @@ ] }, { - "Id": "CCC.AuditLog.C03.TR01", + "Id": "CCC.AuditLog.CN03.AR01", "Description": "When an attempt is made to disable a log source, then an alert MUST be generated.", "Attributes": [ { "FamilyName": "Integrity", "FamilyDescription": "Controls designed to protected the integrity of Audit Log data.", - "Section": "CCC.AuditLog.C03 Alert On Audit Log Changes And Access", + "Section": "CCC.AuditLog.CN03 Alert On Audit Log Changes And Access", "SubSection": "", - "SubSectionObjective": "Ensure that specific alerts have been configured to detect changes in\naudit log configuration such as disabling exporting of logs.\nAlerts MUST also be created to detect changes in retention/object lock policies\nfor exported data log sources/buckets.", + "SubSectionObjective": "Ensure that specific alerts have been configured to detect changes in audit log configuration such as disabling exporting of logs. Alerts MUST also be created to detect changes in retention/object lock policies for exported data log sources/buckets.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Ensure alerting is correctly configured\n", + "Recommendation": "Ensure alerting is correctly configured ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -205,20 +205,20 @@ ] }, { - "Id": "CCC.AuditLog.C03.TR02", - "Description": "When an attempt is made to alter the retention or object lock status\nof an external data log source or bucket, then an alert MUST be generated.", + "Id": "CCC.AuditLog.CN03.AR02", + "Description": "When an attempt is made to alter the retention or object lock status of an external data log source or bucket, then an alert MUST be generated.", "Attributes": [ { "FamilyName": "Integrity", "FamilyDescription": "Controls designed to protected the integrity of Audit Log data.", - "Section": "CCC.AuditLog.C03 Alert On Audit Log Changes And Access", + "Section": "CCC.AuditLog.CN03 Alert On Audit Log Changes And Access", "SubSection": "", - "SubSectionObjective": "Ensure that specific alerts have been configured to detect changes in\naudit log configuration such as disabling exporting of logs.\nAlerts MUST also be created to detect changes in retention/object lock policies\nfor exported data log sources/buckets.", + "SubSectionObjective": "Ensure that specific alerts have been configured to detect changes in audit log configuration such as disabling exporting of logs. Alerts MUST also be created to detect changes in retention/object lock policies for exported data log sources/buckets.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Ensure alerting is correctly configured\n", + "Recommendation": "Ensure alerting is correctly configured ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -251,20 +251,20 @@ ] }, { - "Id": "CCC.AuditLog.C04.TR01", - "Description": "When audit log buckets are created then verify that server access\nlogging MUST be enabled for the audit log bucket,\nwith logs delivered to a separate, secure logging bucket.", + "Id": "CCC.AuditLog.CN04.AR01", + "Description": "When audit log buckets are created then verify that server access logging MUST be enabled for the audit log bucket, with logs delivered to a separate, secure logging bucket.", "Attributes": [ { "FamilyName": "Integrity", "FamilyDescription": "Controls designed to protected the integrity of Audit Log data.", - "Section": "CCC.AuditLog.C04 Ensure Access Logging Is Enabled on the Audit Log Bucket", + "Section": "CCC.AuditLog.CN04 Ensure Access Logging Is Enabled on the Audit Log Bucket", "SubSection": "", - "SubSectionObjective": "Ensure that access logging is enabled for the audit log storage bucket to\ncapture all requests made to the bucket, providing an audit trail of data access.", + "SubSectionObjective": "Ensure that access logging is enabled for the audit log storage bucket to capture all requests made to the bucket, providing an audit trail of data access.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Configure the audit log bucket to enable server access logging.\nEnsure the target logging bucket is configured for appropriate security,\nincluding restricted access and immutability.\n", + "Recommendation": "Configure the audit log bucket to enable server access logging. Ensure the target logging bucket is configured for appropriate security, including restricted access and immutability. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -299,20 +299,20 @@ ] }, { - "Id": "CCC.AuditLog.C05.TR01", + "Id": "CCC.AuditLog.CN05.AR01", "Description": "When audit logs are exported, then audit logs MUST be present in the configured data location.", "Attributes": [ { "FamilyName": "Availability", "FamilyDescription": "Controls designed to protected the availability of Audit Log data.", - "Section": "CCC.AuditLog.C05 Export Audit Logs To Bucket", + "Section": "CCC.AuditLog.CN05 Export Audit Logs To Bucket", "SubSection": "", - "SubSectionObjective": "Configure audit logs to be sent to a external bucket where they can be globally replicated\nand can be subject to greater access control and data retention polices.", + "SubSectionObjective": "Configure audit logs to be sent to a external bucket where they can be globally replicated and can be subject to greater access control and data retention polices.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Configure audit log exporting.\n", + "Recommendation": "Configure audit log exporting. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -348,21 +348,21 @@ ] }, { - "Id": "CCC.AuditLog.C06.TR01", - "Description": "When the retention policy is applied, then data MUST\nbe automatically deleted after the configured number of days.", + "Id": "CCC.AuditLog.CN06.AR01", + "Description": "When the retention policy is applied, then data MUST be automatically deleted after the configured number of days.", "Attributes": [ { "FamilyName": "Availability", "FamilyDescription": "Controls designed to protected the availability of Audit Log data.", - "Section": "CCC.AuditLog.C06 Enforce Retention Policy on Audit Log Bucket", + "Section": "CCC.AuditLog.CN06 Enforce Retention Policy on Audit Log Bucket", "SubSection": "", - "SubSectionObjective": "Configure a custom retention policy on the designated audit log bucket to ensure that logs are\nretained for the correct number of days as defined by your organization's policy.", + "SubSectionObjective": "Configure a custom retention policy on the designated audit log bucket to ensure that logs are retained for the correct number of days as defined by your organization's policy.", "Applicability": [ "tlp-red", "tlp-amber", "tlp-green" ], - "Recommendation": "Configure the audit log bucket's lifecycle rules or object retention settings to enforce\nthe required data retention period.\n", + "Recommendation": "Configure the audit log bucket's lifecycle rules or object retention settings to enforce the required data retention period. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -395,21 +395,21 @@ ] }, { - "Id": "CCC.AuditLog.C07.TR01", - "Description": "When a standard file deletion is attempted on an object within\nthe audit log bucket, then it MUST be prevented unless MFA is provided.", + "Id": "CCC.AuditLog.CN07.AR01", + "Description": "When a standard file deletion is attempted on an object within the audit log bucket, then it MUST be prevented unless MFA is provided.", "Attributes": [ { "FamilyName": "Availability", "FamilyDescription": "Controls designed to protected the availability of Audit Log data.", - "Section": "CCC.AuditLog.C07 Enforce MFA Delete on Audit Log Bucket", + "Section": "CCC.AuditLog.CN07 Enforce MFA Delete on Audit Log Bucket", "SubSection": "", - "SubSectionObjective": "Enable Multi-Factor Authentication (MFA) delete on the audit log bucket to\nprovide greater protection against accidental or malicious deletion of audit data.", + "SubSectionObjective": "Enable Multi-Factor Authentication (MFA) delete on the audit log bucket to provide greater protection against accidental or malicious deletion of audit data.", "Applicability": [ "tlp-red", "tlp-amber", "tlp-green" ], - "Recommendation": "Enable MFA Delete (or equivalent multi-factor authentication for delete operations)\non the audit log bucket.\n", + "Recommendation": "Enable MFA Delete (or equivalent multi-factor authentication for delete operations) on the audit log bucket. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -443,20 +443,20 @@ ] }, { - "Id": "CCC.AuditLog.C08.TR01", - "Description": "When an attempt is made to delete data before the object\nlock period expires, then the deletion MUST be denied.", + "Id": "CCC.AuditLog.CN08.AR01", + "Description": "When an attempt is made to delete data before the object lock period expires, then the deletion MUST be denied.", "Attributes": [ { "FamilyName": "Availability", "FamilyDescription": "Controls designed to protected the availability of Audit Log data.", - "Section": "CCC.AuditLog.C08 Enable Object Lock On Audit Log Bucket", + "Section": "CCC.AuditLog.CN08 Enable Object Lock On Audit Log Bucket", "SubSection": "", - "SubSectionObjective": "Ensure that object log is enabled globally on all objects with the bucket.\nThe lock time MUST be configured to meet your organization, legal and compliance goals.\nDeletion attempts before the lock period MUST be denied.", + "SubSectionObjective": "Ensure that object log is enabled globally on all objects with the bucket. The lock time MUST be configured to meet your organization, legal and compliance goals. Deletion attempts before the lock period MUST be denied.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Configure object lock policy.\n", + "Recommendation": "Configure object lock policy. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -487,20 +487,20 @@ ] }, { - "Id": "CCC.AuditLog.C09.TR01", + "Id": "CCC.AuditLog.CN09.AR01", "Description": "When restricted fields are accessed by unauthorized users, then those fields MUST remain masked.", "Attributes": [ { "FamilyName": "Confidentiality", "FamilyDescription": "Controls designed to protected the confidentiality of Audit Log data.", - "Section": "CCC.AuditLog.C09 Restrict Field And Log Type Access", + "Section": "CCC.AuditLog.CN09 Restrict Field And Log Type Access", "SubSection": "", - "SubSectionObjective": "Configure access to audit logs to follow the principle of least privilege in particular where technically\npossible limit the log fields users have access to to prevent accidental exposure to sensitive\ninformation such as PII.", + "SubSectionObjective": "Configure access to audit logs to follow the principle of least privilege in particular where technically possible limit the log fields users have access to to prevent accidental exposure to sensitive information such as PII.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Review field level access controls on audit data.\n", + "Recommendation": "Review field level access controls on audit data. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -533,21 +533,21 @@ "Checks": [] }, { - "Id": "CCC.AuditLog.C10.TR01", - "Description": "When audit log storage bucket's are created then, bucket's access control settings MUST explicitly deny\npublic read and write access.", + "Id": "CCC.AuditLog.CN10.AR01", + "Description": "When audit log storage bucket's are created then, bucket's access control settings MUST explicitly deny public read and write access.", "Attributes": [ { "FamilyName": "Confidentiality", "FamilyDescription": "Controls designed to protected the confidentiality of Audit Log data.", - "Section": "CCC.AuditLog.C10 Ensure Audit Bucket is Not Publicly Accessible", + "Section": "CCC.AuditLog.CN10 Ensure Audit Bucket is Not Publicly Accessible", "SubSection": "", - "SubSectionObjective": "Ensure that audit log storage buckets are not publicly accessible to prevent\nunauthorized exposure of sensitive log data.", + "SubSectionObjective": "Ensure that audit log storage buckets are not publicly accessible to prevent unauthorized exposure of sensitive log data.", "Applicability": [ "tlp-red", "tlp-amber", "tlp-green" ], - "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access.\nRegularly review bucket permissions to ensure no public access has been inadvertently granted.\n", + "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access. Regularly review bucket permissions to ensure no public access has been inadvertently granted. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -580,21 +580,21 @@ ] }, { - "Id": "CCC.AuditLog.C10.TR02", - "Description": "When the URL of a audit log storage bucket's object is accessed publicly then,\nit should be denied by bucket policy.", + "Id": "CCC.AuditLog.CN10.AR02", + "Description": "When the URL of a audit log storage bucket's object is accessed publicly then, it should be denied by bucket policy.", "Attributes": [ { "FamilyName": "Confidentiality", "FamilyDescription": "Controls designed to protected the confidentiality of Audit Log data.", - "Section": "CCC.AuditLog.C10 Ensure Audit Bucket is Not Publicly Accessible", + "Section": "CCC.AuditLog.CN10 Ensure Audit Bucket is Not Publicly Accessible", "SubSection": "", - "SubSectionObjective": "Ensure that audit log storage buckets are not publicly accessible to prevent\nunauthorized exposure of sensitive log data.", + "SubSectionObjective": "Ensure that audit log storage buckets are not publicly accessible to prevent unauthorized exposure of sensitive log data.", "Applicability": [ "tlp-red", "tlp-amber", "tlp-green" ], - "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access.\nRegularly review bucket permissions to ensure no public access has been inadvertently granted.\n", + "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access. Regularly review bucket permissions to ensure no public access has been inadvertently granted. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -626,7 +626,7 @@ ] }, { - "Id": "CCC.Build.C01.TR01", + "Id": "CCC.Build.CN01.AR01", "Description": "Attempt to initiate a build using an unauthorized build agent and verify that the build is rejected.", "Attributes": [ { @@ -634,7 +634,7 @@ "FamilyDescription": "TODO: Describe this control family", "Section": "", "SubSection": "CCC.Build.C01 Restrict Allowed Build Agents", - "SubSectionObjective": "Ensure that builds are executed only on authorized build agents to maintain\ncontrol over the build environment and prevent unauthorized code execution.", + "SubSectionObjective": "Ensure that builds are executed only on authorized build agents to maintain control over the build environment and prevent unauthorized code execution.", "Applicability": [ "tlp-red", "tlp-amber" @@ -668,15 +668,15 @@ "Checks": [] }, { - "Id": "CCC.Build.C02.TR01", - "Description": "Attempt to trigger a build from an unauthorized external service or\nrepository and verify that the build does not start.", + "Id": "CCC.Build.CN02.AR01", + "Description": "Attempt to trigger a build from an unauthorized external service or repository and verify that the build does not start.", "Attributes": [ { "FamilyName": "Access Control", "FamilyDescription": "TODO: Describe this control family", "Section": "", "SubSection": "CCC.Build.C02 Restrict Allowed External Services for Build Triggers", - "SubSectionObjective": "Ensure that builds can only be triggered by authorized external services or\nrepositories to prevent unauthorized code execution or tampering.", + "SubSectionObjective": "Ensure that builds can only be triggered by authorized external services or repositories to prevent unauthorized code execution or tampering.", "Applicability": [ "tlp-red", "tlp-amber" @@ -710,7 +710,7 @@ "Checks": [] }, { - "Id": "CCC.Build.C03.TR01", + "Id": "CCC.Build.CN03.AR01", "Description": "Attempt to access the build environment from an external network and verify that access is denied.", "Attributes": [ { @@ -718,7 +718,7 @@ "FamilyDescription": "TODO: Describe this control family", "Section": "", "SubSection": "CCC.Build.C03 Deny External Network Access for Build Environments", - "SubSectionObjective": "Ensure that build environments do not have external network access to\nprevent unauthorized external access and data exfiltration.", + "SubSectionObjective": "Ensure that build environments do not have external network access to prevent unauthorized external access and data exfiltration.", "Applicability": [ "tlp-red", "tlp-amber" @@ -760,15 +760,15 @@ ] }, { - "Id": "CCC.CntrReg.C01.TR01", - "Description": "Attempt to push an artifact with known vulnerabilities to the registry\nand observe if it is flagged or rejected by the vulnerability scanning process.", + "Id": "CCC.CntrReg.CN01.AR01", + "Description": "Attempt to push an artifact with known vulnerabilities to the registry and observe if it is flagged or rejected by the vulnerability scanning process.", "Attributes": [ { "FamilyName": "Risk Management", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.CntrReg.C01 Implement Vulnerability Scanning for Artifacts", + "Section": "CCC.CntrReg.CN01 Implement Vulnerability Scanning for Artifacts", "SubSection": "", - "SubSectionObjective": "Ensure that container images and artifacts stored in the container registry are scanned for\nvulnerabilities to identify and remediate security issues before deployment.", + "SubSectionObjective": "Ensure that container images and artifacts stored in the container registry are scanned for vulnerabilities to identify and remediate security issues before deployment.", "Applicability": [ "tlp-red", "tlp-amber" @@ -805,56 +805,15 @@ ] }, { - "Id": "CCC.CntrReg.C02.TR01", - "Description": "Confirm that artifacts older than the specified retention period are automatically\ndeleted from the registry.", - "Attributes": [ - { - "FamilyName": "Data Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.CntrReg.C02 Implement Cleanup Policies for Artifacts", - "SubSection": "", - "SubSectionObjective": "Ensure that unused or outdated artifacts are cleaned up according to defined policies to\nmanage storage effectively and reduce security risks associated with outdated versions.", - "Applicability": [ - "tlp-red", - "tlp-amber" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.TH14" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.IP-6" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SI-12" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.DataWar.C01.TR01", - "Description": "Attempt to access underlying database tables directly without\nusing managed views and verify that access is denied.", + "Id": "CCC.DataWar.CN01.AR01", + "Description": "Attempt to access underlying database tables directly without using managed views and verify that access is denied.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.DataWar.C01 Enforce Use of Managed Views for Data Access", + "Section": "CCC.DataWar.CN01 Enforce Use of Managed Views for Data Access", "SubSection": "", - "SubSectionObjective": "Ensure that data access is provided through managed views, restricting users\nfrom accessing underlying tables directly and enforcing consistent security policies.", + "SubSectionObjective": "Ensure that data access is provided through managed views, restricting users from accessing underlying tables directly and enforcing consistent security policies.", "Applicability": [ "tlp-red", "tlp-amber" @@ -888,15 +847,15 @@ "Checks": [] }, { - "Id": "CCC.DataWar.C02.TR01", - "Description": "Attempt to query sensitive columns without the necessary permissions and\nverify that access is denied or data is masked.", + "Id": "CCC.DataWar.CN02.AR01", + "Description": "Attempt to query sensitive columns without the necessary permissions and verify that access is denied or data is masked.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.DataWar.C02 Enforce Column-Level Security Policies", + "Section": "CCC.DataWar.CN02 Enforce Column-Level Security Policies", "SubSection": "", - "SubSectionObjective": "Ensure that access to sensitive data columns is restricted based on user roles,\npreventing unauthorized access to sensitive information.", + "SubSectionObjective": "Ensure that access to sensitive data columns is restricted based on user roles, preventing unauthorized access to sensitive information.", "Applicability": [ "tlp-red", "tlp-amber" @@ -930,15 +889,15 @@ "Checks": [] }, { - "Id": "CCC.DataWar.C03.TR01", - "Description": "Attempt to query data rows that the user should not have access to and verify\nthat access is denied or data is not returned.", + "Id": "CCC.DataWar.CN03.AR01", + "Description": "Attempt to query data rows that the user should not have access to and verify that access is denied or data is not returned.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.DataWar.C03 Enforce Row-Level Security Policies", + "Section": "CCC.DataWar.CN03 Enforce Row-Level Security Policies", "SubSection": "", - "SubSectionObjective": "Ensure that access to data rows is restricted based on user roles or attributes,\npreventing unauthorized access to specific subsets of data.", + "SubSectionObjective": "Ensure that access to data rows is restricted based on user roles or attributes, preventing unauthorized access to specific subsets of data.", "Applicability": [ "tlp-red", "tlp-amber" @@ -995,730 +954,13 @@ ] }, { - "Id": "CCC.GenAI.C01.TR01", - "Description": "Untrusted input such as user queries, RAG data or tool output\nMUST be validated before it is passed to a GenAI model.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C01 Model Input Filtering and Sanitisation", - "SubSection": "", - "SubSectionObjective": "Inspect and validate input before it is passed to a GenAI\nmodel in order to filter or sanitise adversarial queries\nand prevent sensitive data leakage.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH01", - "CCC.GenAI.TH03" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-003", - "AIR-PREV-017", - "AIR-PREV-002", - "AIR-DET-001" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Input Validation and Sanitization" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0020", - "AML.M0021", - "AML.M0015" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.GenAI.C01.TR02", - "Description": "If malicious patterns such as prompt injection or sensitive\ndata are detected during input validation, the input MUST\nbe blocked or sanitised.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C01 Model Input Filtering and Sanitisation", - "SubSection": "", - "SubSectionObjective": "Inspect and validate input before it is passed to a GenAI\nmodel in order to filter or sanitise adversarial queries\nand prevent sensitive data leakage.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH01", - "CCC.GenAI.TH03" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-003", - "AIR-PREV-017", - "AIR-PREV-002", - "AIR-DET-001" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Input Validation and Sanitization" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0020", - "AML.M0021", - "AML.M0015" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.GenAI.C02.TR01", - "Description": "GenAI model output MUST be validated for format conformance,\nmalicious patterns, sensitive data and inapropriate content\nbefore being passed to users, application or plugins.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C02 Model Output Filtering and Sanitisation", - "SubSection": "", - "SubSectionObjective": "Inspect and validate GenAI model output before passing it to\nusers, applications or plugins in order to filter or sanitise\ninsecure or unreliable output and prevent sensitive data leakage.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH01", - "CCC.GenAI.TH03", - "CCC.GenAI.TH04", - "CCC.GenAI.TH05", - "CCC.GenAI.TH06" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-003", - "AIR-PREV-017", - "AIR-PREV-002", - "AIR-DET-001" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Output Validation and Sanitization" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0020", - "AML.M0002" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.GenAI.C02.TR02", - "Description": "In the event of policy violations, the AI-generated content MUST\nbe redacted, encoded or rejected.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C02 Model Output Filtering and Sanitisation", - "SubSection": "", - "SubSectionObjective": "Inspect and validate GenAI model output before passing it to\nusers, applications or plugins in order to filter or sanitise\ninsecure or unreliable output and prevent sensitive data leakage.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH01", - "CCC.GenAI.TH03", - "CCC.GenAI.TH04", - "CCC.GenAI.TH05", - "CCC.GenAI.TH06" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-003", - "AIR-PREV-017", - "AIR-PREV-002", - "AIR-DET-001" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Output Validation and Sanitization" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0020", - "AML.M0002" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.GenAI.C03.TR01", - "Description": "When data is designated for model training or RAG ingestion, then its\nsource MUST be explicitly approved and its provenance documented.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C03 Data Provenance and Source Vetting", - "SubSection": "", - "SubSectionObjective": "Ensure that all data for training, fine-tuning or RAG comes\nfrom trusted, approved sources and is authorised for the\nintended purposes in order to prevent the initial introduction\nof malicious content or leaked sensitive data.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH02", - "CCC.GenAI.TH03" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-006" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Training Data Management" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0025" - ] - } - ] - } - ], - "Checks": [ - "dataproc_encrypted_with_cmks_disabled", - "bigquery_dataset_cmk_encryption", - "bigquery_dataset_public_access", - "bigquery_table_cmk_encryption", - "cloudstorage_bucket_public_access", - "cloudstorage_bucket_uniform_bucket_level_access", - "cloudstorage_bucket_log_retention_policy_lock", - "kms_key_not_publicly_accessible", - "logging_sink_created", - "iam_audit_logs_enabled", - "iam_cloud_asset_inventory_enabled", - "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled" - ] - }, - { - "Id": "CCC.GenAI.C03.TR02", - "Description": "Data from unvetted sources MUST NOT be used in production systems.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C03 Data Provenance and Source Vetting", - "SubSection": "", - "SubSectionObjective": "Ensure that all data for training, fine-tuning or RAG comes\nfrom trusted, approved sources and is authorised for the\nintended purposes in order to prevent the initial introduction\nof malicious content or leaked sensitive data.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH02", - "CCC.GenAI.TH03" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-006" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Training Data Management" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0025" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.GenAI.C04.TR01", - "Description": "When data is ingested for training, fine-tuning or conversion\nto vector embeddings, it MUST be validated for sensitive\ninformation or malicious content.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C04 Sanitisation of Ingested Data", - "SubSection": "", - "SubSectionObjective": "Validate and sanitise all data ingested by GenAI systems\nfrom extenal sources or internal knowledge bases, whether\nfor training, conversion to vector embeddings, or real-time\nretireval, in order to remove or redact poisoned or sensitive\ndata before further processing.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH02", - "CCC.GenAI.TH03" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-002" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Training Data Sanitization" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0007" - ] - } - ] - } - ], - "Checks": [ - "cloudstorage_bucket_public_access", - "cloudstorage_bucket_uniform_bucket_level_access", - "gcr_container_scanning_enabled", - "compute_instance_public_ip", - "compute_firewall_ssh_access_from_the_internet_allowed", - "compute_firewall_rdp_access_from_the_internet_allowed", - "dataproc_encrypted_with_cmks_disabled", - "bigquery_dataset_public_access", - "bigquery_table_cmk_encryption", - "cloudsql_instance_public_access", - "kms_key_not_publicly_accessible" - ] - }, - { - "Id": "CCC.GenAI.C04.TR02", - "Description": "If sensitive data or malicious content is detected, it must\nbe rejected, redacted or flagged for manual review.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C04 Sanitisation of Ingested Data", - "SubSection": "", - "SubSectionObjective": "Validate and sanitise all data ingested by GenAI systems\nfrom extenal sources or internal knowledge bases, whether\nfor training, conversion to vector embeddings, or real-time\nretireval, in order to remove or redact poisoned or sensitive\ndata before further processing.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH02", - "CCC.GenAI.TH03" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-002" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Training Data Sanitization" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0007" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.GenAI.C05.TR01", - "Description": "When a RAG-enabled system generates a response containing information\nretrieved from its knowledge base, then the response MUST include a\nverifiable citation that links back to the specific source document.", - "Attributes": [ - { - "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", - "Section": "CCC.GenAI.C05 Citations and Source Traceability", - "SubSection": "", - "SubSectionObjective": "Require the GenAI system to provide citations or direct links\nback to the source documents used to generate a response, in\nto enhance the transparency, trustworthiness, and verifiability\nof AI-generated content.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH09", - "CCC.GenAI.TH04" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-DET-013" - ] - } - ] - } - ], - "Checks": [ - "iam_audit_logs_enabled", - "logging_sink_created", - "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", - "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", - "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled", - "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled", - "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", - "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", - "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled", - "iam_cloud_asset_inventory_enabled" - ] - }, - { - "Id": "CCC.GenAI.C06.TR01", - "Description": "When an LLM invokes an external tool (e.g., an API, a plugin),\nthen the tool MUST operate with the least privileges required\nfor performing its intended functionality.", - "Attributes": [ - { - "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", - "Section": "CCC.GenAI.C06 Least Privilege for Plugins", - "SubSection": "", - "SubSectionObjective": "Restricts the permissions of any external tools the GenAI system\ncan call to limit the potential damage if an agent is coerced\nto perform unintended actions or vulnerabilities in the tools\nare exploited.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH07", - "CCC.GenAI.TH06" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Agent Permissions" - ] - } - ] - } - ], - "Checks": [ - "apikeys_api_restrictions_configured", - "compute_instance_default_service_account_in_use_with_full_api_access", - "compute_instance_default_service_account_in_use", - "gke_cluster_no_default_service_account", - "iam_no_service_roles_at_project_level", - "iam_sa_no_administrative_privileges", - "iam_sa_no_user_managed_keys", - "iam_sa_user_managed_key_rotate_90_days", - "iam_sa_user_managed_key_unused", - "iam_service_account_unused" - ] - }, - { - "Id": "CCC.GenAI.C07.TR01", - "Description": "When an application makes an API call to a foundational model in a\nproduction environment, then it MUST specify an explicit version\nidentifier.", - "Attributes": [ - { - "FamilyName": "Configuration Management", - "FamilyDescription": "The Configuration Management control family involves establishing,\nmaintaining and monitoring the configuration of the service and\nrelated applications and infrastructure to ensure consistency,\nsecure defaults and compliance.\n", - "Section": "CCC.GenAI.C07 Model Version Pinning", - "SubSection": "", - "SubSectionObjective": "Mandate that applications are locked (\"pinned\") to a specific,\ntested version of a foundational model to prevent unexpected\nbehaviour changes introduced by provider-side updates.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH10" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-010" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.GenAI.C08.TR01", - "Description": "When a new AI model is considered for production deployment, it\nMUST undergo a formal red teaming and quality assurance review.", - "Attributes": [ - { - "FamilyName": "Model Assurance and Evaluation", - "FamilyDescription": "The Model Assurance and Evaluation control family encompasses\nthe proactiveand continuous processes of testing and validating\nthe AI model's behavior to ensure it aligns with safety, ethical,\nand quality standards.\n", - "Section": "CCC.GenAI.C08 Quality Control and Red Teaming", - "SubSection": "", - "SubSectionObjective": "Establish a formal program for quality evaluation and adversarial\ntesting (red teaming) to ensure GenAI system meet all business,\nquality, security and compliance requirements before getting deployed\ninto production environments.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH01", - "CCC.GenAI.TH02", - "CCC.GenAI.TH04", - "CCC.GenAI.TH08", - "CCC.GenAI.TH10" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-005" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Adversarial Training and Testing", - "Red Teaming", - "Product Governance" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0008" - ] - } - ] - } - ], - "Checks": [ - "artifacts_container_analysis_enabled", - "gcr_container_scanning_enabled", - "cloudstorage_bucket_public_access", - "cloudstorage_bucket_log_retention_policy_lock", - "iam_audit_logs_enabled", - "iam_cloud_asset_inventory_enabled", - "logging_sink_created", - "bigquery_dataset_cmk_encryption", - "bigquery_table_cmk_encryption", - "kms_key_not_publicly_accessible", - "kms_key_rotation_enabled", - "dataproc_encrypted_with_cmks_disabled" - ] - }, - { - "Id": "CCC.GenAI.C08.TR02", - "Description": "If model quality review or red teaming identifies an issue that exceeds\nthe organization's risk tolerance, the model MUST NOT be deployed until\nthe issue is remediated.", - "Attributes": [ - { - "FamilyName": "Model Assurance and Evaluation", - "FamilyDescription": "The Model Assurance and Evaluation control family encompasses\nthe proactiveand continuous processes of testing and validating\nthe AI model's behavior to ensure it aligns with safety, ethical,\nand quality standards.\n", - "Section": "CCC.GenAI.C08 Quality Control and Red Teaming", - "SubSection": "", - "SubSectionObjective": "Establish a formal program for quality evaluation and adversarial\ntesting (red teaming) to ensure GenAI system meet all business,\nquality, security and compliance requirements before getting deployed\ninto production environments.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.GenAI.TH01", - "CCC.GenAI.TH02", - "CCC.GenAI.TH04", - "CCC.GenAI.TH08", - "CCC.GenAI.TH10" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "FINOS-AIGF", - "Identifiers": [ - "AIR-PREV-005" - ] - }, - { - "ReferenceId": "SAIF", - "Identifiers": [ - "Adversarial Training and Testing", - "Red Teaming", - "Product Governance" - ] - }, - { - "ReferenceId": "MITRE-ATLAS", - "Identifiers": [ - "AML.M0008" - ] - } - ] - } - ], - "Checks": [ - "dataproc_encrypted_with_cmks_disabled", - "gcr_container_scanning_enabled", - "artifacts_container_analysis_enabled", - "iam_audit_logs_enabled", - "iam_cloud_asset_inventory_enabled", - "logging_sink_created", - "kms_key_not_publicly_accessible", - "bigquery_dataset_cmk_encryption", - "bigquery_dataset_public_access" - ] - }, - { - "Id": "CCC.KeyMgmt.C01.TR01", - "Description": "When a key version is scheduled for deletion or disabled, an\nalert MUST be generated within five minutes.", + "Id": "CCC.KeyMgmt.CN01.AR01", + "Description": "When a key version is scheduled for deletion or disabled, an alert MUST be generated within five minutes.", "Attributes": [ { "FamilyName": "Logging and Metrics Publication", "FamilyDescription": "Controls that collect, alert, and retain key-management events.", - "Section": "CCC.KeyMgmt.C01 Alert on Key-version Changes", + "Section": "CCC.KeyMgmt.CN01 Alert on Key-version Changes", "SubSection": "", "SubSectionObjective": "Generate near-real-time alerts when a KMS key version is disabled or scheduled for deletion, enabling rapid investigation and recovery.", "Applicability": [ @@ -1753,13 +995,13 @@ "Checks": [] }, { - "Id": "CCC.KeyMgmt.C02.TR01", - "Description": "When IAM roles and key policies are reviewed, Decrypt permission\nMUST be granted exclusively to documented authorised principals.", + "Id": "CCC.KeyMgmt.CN02.AR01", + "Description": "When IAM roles and key policies are reviewed, Decrypt permission MUST be granted exclusively to documented authorised principals.", "Attributes": [ { "FamilyName": "Identity and Access Management", "FamilyDescription": "Controls that enforce least-privilege use of KMS operations.", - "Section": "CCC.KeyMgmt.C02 Limit Decrypt Permissions", + "Section": "CCC.KeyMgmt.CN02 Limit Decrypt Permissions", "SubSection": "", "SubSectionObjective": "Restrict the Decrypt operation to authorised principals only, applying the principle of least privilege to protect sensitive data.", "Applicability": [ @@ -1796,13 +1038,13 @@ ] }, { - "Id": "CCC.KeyMgmt.C03.TR01", - "Description": "When rotation settings are examined, rotation MUST be enabled with\nan interval not exceeding 365 days.", + "Id": "CCC.KeyMgmt.CN03.AR01", + "Description": "When rotation settings are examined, rotation MUST be enabled with an interval not exceeding 365 days.", "Attributes": [ { "FamilyName": "Key Lifecycle Management", "FamilyDescription": "Controls that govern creation, rotation, import, and retirement of cryptographic keys.", - "Section": "CCC.KeyMgmt.C03 Enforce Automatic Rotation", + "Section": "CCC.KeyMgmt.CN03 Enforce Automatic Rotation", "SubSection": "", "SubSectionObjective": "Ensure symmetric keys rotate automatically within policy intervals to reduce exposure of key material.", "Applicability": [ @@ -1838,13 +1080,13 @@ ] }, { - "Id": "CCC.KeyMgmt.C04.TR01", - "Description": "When a key import request is processed, the key MUST use an\napproved algorithm (RSA-2048+, EC-P256+) and originate from a\ncertified HSM.", + "Id": "CCC.KeyMgmt.CN04.AR01", + "Description": "When a key import request is processed, the key MUST use an approved algorithm (RSA-2048+, EC-P256+) and originate from a certified HSM.", "Attributes": [ { "FamilyName": "Key Lifecycle Management", "FamilyDescription": "Controls that govern creation, rotation, import, and retirement of cryptographic keys.", - "Section": "CCC.KeyMgmt.C04 Validate Imported Keys", + "Section": "CCC.KeyMgmt.CN04 Validate Imported Keys", "SubSection": "", "SubSectionObjective": "Accept only externally generated keys that meet approved cryptographic strength and provenance requirements.", "Applicability": [ @@ -1881,13 +1123,13 @@ ] }, { - "Id": "CCC.LB.C01.TR01", - "Description": "When a single client sends more than 2000 requests within any\n5-minute sliding window, the load balancer MUST throttle all\nsubsequent requests from that client for at least 60 seconds.", + "Id": "CCC.LB.CN01.AR01", + "Description": "When a single client sends more than 2000 requests within any 5-minute sliding window, the load balancer MUST throttle all subsequent requests from that client for at least 60 seconds.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "Controls that detect anomalous traffic and record load-balancer activity.\n", - "Section": "CCC.LB.C01 Enforce and Detect Rate Limiting", + "FamilyDescription": "Controls that detect anomalous traffic and record load-balancer activity. ", + "Section": "CCC.LB.CN01 Enforce and Detect Rate Limiting", "SubSection": "", "SubSectionObjective": "Detect and throttle malicious or excessive requests to prevent downstream resource exhaustion and brute-force activity.", "Applicability": [ @@ -1895,7 +1137,7 @@ "tlp-amber", "tlp-red" ], - "Recommendation": "Implement per-IP token-bucket limits with and verify via\nsynthetic traffic tests.\n", + "Recommendation": "Implement per-IP token-bucket limits with and verify via synthetic traffic tests. ", "SectionThreatMappings": [ { "ReferenceId": "LB", @@ -1936,13 +1178,13 @@ ] }, { - "Id": "CCC.LB.C01.TR02", - "Description": "When throttling is invoked, the load balancer MUST\nrecord the event in the access log within 5 minutes\nfor alerting and trend analysis.", + "Id": "CCC.LB.CN01.AR02", + "Description": "When throttling is invoked, the load balancer MUST record the event in the access log within 5 minutes for alerting and trend analysis.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "Controls that detect anomalous traffic and record load-balancer activity.\n", - "Section": "CCC.LB.C01 Enforce and Detect Rate Limiting", + "FamilyDescription": "Controls that detect anomalous traffic and record load-balancer activity. ", + "Section": "CCC.LB.CN01 Enforce and Detect Rate Limiting", "SubSection": "", "SubSectionObjective": "Detect and throttle malicious or excessive requests to prevent downstream resource exhaustion and brute-force activity.", "Applicability": [ @@ -1950,7 +1192,7 @@ "tlp-amber", "tlp-red" ], - "Recommendation": "Enable access logging and configure metric filters\non HTTP 429 counts to trigger alerts.\n", + "Recommendation": "Enable access logging and configure metric filters on HTTP 429 counts to trigger alerts. ", "SectionThreatMappings": [ { "ReferenceId": "LB", @@ -1986,21 +1228,21 @@ ] }, { - "Id": "CCC.LB.C06.TR01", - "Description": "When more than 10 percent of targets change from healthy to\nunhealthy within five minutes, an alert MUST be issued.", + "Id": "CCC.LB.CN06.AR01", + "Description": "When more than 10 percent of targets change from healthy to unhealthy within five minutes, an alert MUST be issued.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "Controls that detect anomalous traffic and record load-balancer activity.\n", - "Section": "CCC.LB.C06 Secure Health-Check Telemetry", + "FamilyDescription": "Controls that detect anomalous traffic and record load-balancer activity. ", + "Section": "CCC.LB.CN06 Secure Health-Check Telemetry", "SubSection": "", - "SubSectionObjective": "Monitor health-check endpoints for tampering and alert on\nabnormal status changes.", + "SubSectionObjective": "Monitor health-check endpoints for tampering and alert on abnormal status changes.", "Applicability": [ "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Instrument metrics for health check results and target\nremoval events. Configure monitoring alarms to alert\non abnormal spikes in unhealthy targets.\n", + "Recommendation": "Instrument metrics for health check results and target removal events. Configure monitoring alarms to alert on abnormal spikes in unhealthy targets. ", "SectionThreatMappings": [ { "ReferenceId": "LB", @@ -2032,21 +1274,21 @@ ] }, { - "Id": "CCC.LB.C04.TR01", - "Description": "When routing weights change, the request MUST originate\nfrom an explicitly defined and trusted identity and MUST\nbe logged.", + "Id": "CCC.LB.CN04.AR01", + "Description": "When routing weights change, the request MUST originate from an explicitly defined and trusted identity and MUST be logged.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "Controls that restrict who can change or query load-balancer resources.\n", - "Section": "CCC.LB.C04 Enforce Distribution Policies", + "FamilyDescription": "Controls that restrict who can change or query load-balancer resources. ", + "Section": "CCC.LB.CN04 Enforce Distribution Policies", "SubSection": "", - "SubSectionObjective": "Ensure traffic-splitting weights and algorithms are modified\nonly by trusted identities.", + "SubSectionObjective": "Ensure traffic-splitting weights and algorithms are modified only by trusted identities.", "Applicability": [ "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Define a list of trusted principals allowed to modify\nrouting configurations. Enforce via conditional access\npolicies, and log changes using audit logging.\n", + "Recommendation": "Define a list of trusted principals allowed to modify routing configurations. Enforce via conditional access policies, and log changes using audit logging. ", "SectionThreatMappings": [ { "ReferenceId": "LB", @@ -2083,15 +1325,15 @@ ] }, { - "Id": "CCC.LB.C05.TR01", - "Description": "When stickiness is enabled, session cookies MUST expire\nwithin 30 minutes of inactivity.", + "Id": "CCC.LB.CN05.AR01", + "Description": "When stickiness is enabled, session cookies MUST expire within 30 minutes of inactivity.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "Controls that restrict who can change or query load-balancer resources.\n", - "Section": "CCC.LB.C05 Validate Session Affinity", + "FamilyDescription": "Controls that restrict who can change or query load-balancer resources. ", + "Section": "CCC.LB.CN05 Validate Session Affinity", "SubSection": "", - "SubSectionObjective": "Configure session persistence to minimise fixation and hijacking\nrisks.", + "SubSectionObjective": "Configure session persistence to minimise fixation and hijacking risks.", "Applicability": [ "tlp-green", "tlp-amber", @@ -2139,15 +1381,15 @@ ] }, { - "Id": "CCC.LB.C09.TR01", - "Description": "When an API call originates outside the approved CIDR\nset, the request MUST be denied.", + "Id": "CCC.LB.CN09.AR01", + "Description": "When an API call originates outside the approved CIDR set, the request MUST be denied.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "Controls that restrict who can change or query load-balancer resources.\n", - "Section": "CCC.LB.C09 Restrict Management API Access", + "FamilyDescription": "Controls that restrict who can change or query load-balancer resources. ", + "Section": "CCC.LB.CN09 Restrict Management API Access", "SubSection": "", - "SubSectionObjective": "Limit load-balancer API calls to authorised identities and\ntrusted networks.", + "SubSectionObjective": "Limit load-balancer API calls to authorised identities and trusted networks.", "Applicability": [ "tlp-green", "tlp-amber", @@ -2194,15 +1436,15 @@ ] }, { - "Id": "CCC.LB.C02.TR01", - "Description": "When concurrent connections reach 80 percent of capacity, the\nautoscaling group MUST add at least one instance within five\nminutes.", + "Id": "CCC.LB.CN02.AR01", + "Description": "When concurrent connections reach 80 percent of capacity, the autoscaling group MUST add at least one instance within five minutes.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls that preserve availability and confidentiality of\ntraffic processed by the load balancer.\n", - "Section": "CCC.LB.C02 Auto-Scale Load Balancer Capacity", + "FamilyDescription": "Controls that preserve availability and confidentiality of traffic processed by the load balancer. ", + "Section": "CCC.LB.CN02 Auto-Scale Load Balancer Capacity", "SubSection": "", - "SubSectionObjective": "Expand load-balancer capacity to maintain availability during traffic\nspikes.", + "SubSectionObjective": "Expand load-balancer capacity to maintain availability during traffic spikes.", "Applicability": [ "tlp-green", "tlp-amber", @@ -2236,15 +1478,15 @@ "Checks": [] }, { - "Id": "CCC.LB.C07.TR01", - "Description": "When responses pass through the load balancer, the\n\"Server\" header MUST be replaced with \"lb\".", + "Id": "CCC.LB.CN07.AR01", + "Description": "When responses pass through the load balancer, the \"Server\" header MUST be replaced with \"lb\".", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls that preserve availability and confidentiality of\ntraffic processed by the load balancer.\n", - "Section": "CCC.LB.C07 Scrub Sensitive Headers", + "FamilyDescription": "Controls that preserve availability and confidentiality of traffic processed by the load balancer. ", + "Section": "CCC.LB.CN07 Scrub Sensitive Headers", "SubSection": "", - "SubSectionObjective": "Remove headers that disclose internal details or software\nversions from HTTP responses.", + "SubSectionObjective": "Remove headers that disclose internal details or software versions from HTTP responses.", "Applicability": [ "tlp-green", "tlp-amber", @@ -2278,15 +1520,15 @@ "Checks": [] }, { - "Id": "CCC.LB.C08.TR01", - "Description": "When a certificate is within 30 days of expiry, automated renewal\nMUST complete and deploy a new certificate within 24 hours.", + "Id": "CCC.LB.CN08.AR01", + "Description": "When a certificate is within 30 days of expiry, automated renewal MUST complete and deploy a new certificate within 24 hours.", "Attributes": [ { "FamilyName": "Encryption", "FamilyDescription": "Controls that ensure trustworthy TLS certificates and ciphers.", - "Section": "CCC.LB.C08 Automate Certificate Renewal", + "Section": "CCC.LB.CN08 Automate Certificate Renewal", "SubSection": "", - "SubSectionObjective": "Maintain valid TLS certificates by automating renewal and\ndeployment before expiry.", + "SubSectionObjective": "Maintain valid TLS certificates by automating renewal and deployment before expiry.", "Applicability": [ "tlp-green", "tlp-amber", @@ -2320,15 +1562,15 @@ "Checks": [] }, { - "Id": "CCC.Logging.C01.TR01", - "Description": "When a new cloud account is created, provider-level audit and network flow logging MUST be\nenabled by default and directed to the central sink.", + "Id": "CCC.Logging.CN01.AR01", + "Description": "When a new cloud account is created, provider-level audit and network flow logging MUST be enabled by default and directed to the central sink.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data.\n", - "Section": "CCC.Logging.C01 Centralized and Comprehensive Log Aggregation", + "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data. ", + "Section": "CCC.Logging.CN01 Centralized and Comprehensive Log Aggregation", "SubSection": "", - "SubSectionObjective": "Ensure all operational and security logs from across the cloud environment, including\napplications, operating systems, network traffic, and cloud service activity, are captured\nautomatically and streamed to a central, secure log management service.", + "SubSectionObjective": "Ensure all operational and security logs from across the cloud environment, including applications, operating systems, network traffic, and cloud service activity, are captured automatically and streamed to a central, secure log management service.", "Applicability": [ "tlp-clear", "tlp-green", @@ -2368,15 +1610,15 @@ ] }, { - "Id": "CCC.Logging.C01.TR02", - "Description": "When a new cloud compute resource is deployed, it MUST be configured to forward all relevant\nlogs (e.g., OS, application, service logs) to the central log sink.", + "Id": "CCC.Logging.CN01.AR02", + "Description": "When a new cloud compute resource is deployed, it MUST be configured to forward all relevant logs (e.g., OS, application, service logs) to the central log sink.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data.\n", - "Section": "CCC.Logging.C01 Centralized and Comprehensive Log Aggregation", + "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data. ", + "Section": "CCC.Logging.CN01 Centralized and Comprehensive Log Aggregation", "SubSection": "", - "SubSectionObjective": "Ensure all operational and security logs from across the cloud environment, including\napplications, operating systems, network traffic, and cloud service activity, are captured\nautomatically and streamed to a central, secure log management service.", + "SubSectionObjective": "Ensure all operational and security logs from across the cloud environment, including applications, operating systems, network traffic, and cloud service activity, are captured automatically and streamed to a central, secure log management service.", "Applicability": [ "tlp-clear", "tlp-green", @@ -2419,15 +1661,15 @@ ] }, { - "Id": "CCC.Logging.C02.TR01", - "Description": "When a new log bucket or stream is created, its retention policy MUST be configured\nin accordance with organisation's data retention policy.", + "Id": "CCC.Logging.CN02.AR01", + "Description": "When a new log bucket or stream is created, its retention policy MUST be configured in accordance with organisation's data retention policy.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data.\n", - "Section": "CCC.Logging.C02 Enforce Data Retention Policy for Logs", + "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data. ", + "Section": "CCC.Logging.CN02 Enforce Data Retention Policy for Logs", "SubSection": "", - "SubSectionObjective": "Ensure that the retention period configured for logs aligns with the organization's\ndata retention policy.", + "SubSectionObjective": "Ensure that the retention period configured for logs aligns with the organization's data retention policy.", "Applicability": [ "tlp-clear", "tlp-green", @@ -2464,15 +1706,15 @@ ] }, { - "Id": "CCC.Logging.C02.TR02", - "Description": "When a query is performed to retrieve log events older than the number of days defined\nin the organisation's data retention policy, it MUST return an empty result.", + "Id": "CCC.Logging.CN02.AR02", + "Description": "When a query is performed to retrieve log events older than the number of days defined in the organisation's data retention policy, it MUST return an empty result.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data.\n", - "Section": "CCC.Logging.C02 Enforce Data Retention Policy for Logs", + "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data. ", + "Section": "CCC.Logging.CN02 Enforce Data Retention Policy for Logs", "SubSection": "", - "SubSectionObjective": "Ensure that the retention period configured for logs aligns with the organization's\ndata retention policy.", + "SubSectionObjective": "Ensure that the retention period configured for logs aligns with the organization's data retention policy.", "Applicability": [ "tlp-clear", "tlp-green", @@ -2509,20 +1751,20 @@ ] }, { - "Id": "CCC.AuditLog.C08.TR01", - "Description": "When an attempt is made to modify or delete data before the object\nlock period expires, then the action MUST be denied.", + "Id": "CCC.AuditLog.CN08.AR01", + "Description": "When an attempt is made to modify or delete data before the object lock period expires, then the action MUST be denied.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data.\n", - "Section": "CCC.Logging.C03 Enable Object Lock On Log Bucket", + "FamilyDescription": "Controls related to the confidentiality, integrity and availability of log data. ", + "Section": "CCC.Logging.CN03 Enable Object Lock On Log Bucket", "SubSection": "", - "SubSectionObjective": "Ensure log immutability by enabling Write Once, Read Many (WORM) protection\nusing object lock on log storage buckets. This prevents logs from being modified\nor deleted during the defined retention period, supporting compliance and forensic\nintegrity.", + "SubSectionObjective": "Ensure log immutability by enabling Write Once, Read Many (WORM) protection using object lock on log storage buckets. This prevents logs from being modified or deleted during the defined retention period, supporting compliance and forensic integrity.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Configure object lock policy.\n", + "Recommendation": "Configure object lock policy. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -2553,20 +1795,20 @@ ] }, { - "Id": "CCC.AuditLog.C04.TR01", + "Id": "CCC.AuditLog.CN04.AR01", "Description": "When restricted fields are accessed by unauthorized users, then those fields MUST remain masked.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "Controls that restrict who can access and modify logs.\n", - "Section": "CCC.Logging.C04 Restrict Field And Log Type Access", + "FamilyDescription": "Controls that restrict who can access and modify logs. ", + "Section": "CCC.Logging.CN04 Restrict Field And Log Type Access", "SubSection": "", - "SubSectionObjective": "Configure access to logs to follow the principle of least privilege in particular where technically\npossible limit the log fields users have access to to prevent accidental exposure to sensitive\ninformation such as PII.", + "SubSectionObjective": "Configure access to logs to follow the principle of least privilege in particular where technically possible limit the log fields users have access to to prevent accidental exposure to sensitive information such as PII.", "Applicability": [ "tlp-red", "tlp-amber" ], - "Recommendation": "Review field level access controls on log data.\n", + "Recommendation": "Review field level access controls on log data. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -2599,21 +1841,21 @@ "Checks": [] }, { - "Id": "CCC.Logging.C05.TR01", - "Description": "When a log storage bucket is created, the bucket's access control settings MUST\nexplicitly deny public read and write access.", + "Id": "CCC.Logging.CN05.AR01", + "Description": "When a log storage bucket is created, the bucket's access control settings MUST explicitly deny public read and write access.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "Controls that restrict who can access and modify logs.\n", - "Section": "CCC.Logging.C05 Ensure Log Bucket is Not Publicly Accessible", + "FamilyDescription": "Controls that restrict who can access and modify logs. ", + "Section": "CCC.Logging.CN05 Ensure Log Bucket is Not Publicly Accessible", "SubSection": "", - "SubSectionObjective": "Ensure that log storage buckets are not publicly accessible to prevent unauthorized\naccess to sensitive log data. In addition, logs should be replicated to another cloud\nregion to enhance availability, durability, and support disaster recovery requirements.", + "SubSectionObjective": "Ensure that log storage buckets are not publicly accessible to prevent unauthorized access to sensitive log data. In addition, logs should be replicated to another cloud region to enhance availability, durability, and support disaster recovery requirements.", "Applicability": [ "tlp-red", "tlp-amber", "tlp-green" ], - "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access.\nRegularly review bucket permissions to ensure no public access has been inadvertently granted.\n", + "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access. Regularly review bucket permissions to ensure no public access has been inadvertently granted. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -2647,21 +1889,21 @@ ] }, { - "Id": "CCC.Logging.C05.TR02", - "Description": "When the URL of a log storage bucket's object is accessed publicly, the action MUST be denied\nby bucket policy.", + "Id": "CCC.Logging.CN05.AR02", + "Description": "When the URL of a log storage bucket's object is accessed publicly, the action MUST be denied by bucket policy.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "Controls that restrict who can access and modify logs.\n", - "Section": "CCC.Logging.C05 Ensure Log Bucket is Not Publicly Accessible", + "FamilyDescription": "Controls that restrict who can access and modify logs. ", + "Section": "CCC.Logging.CN05 Ensure Log Bucket is Not Publicly Accessible", "SubSection": "", - "SubSectionObjective": "Ensure that log storage buckets are not publicly accessible to prevent unauthorized\naccess to sensitive log data. In addition, logs should be replicated to another cloud\nregion to enhance availability, durability, and support disaster recovery requirements.", + "SubSectionObjective": "Ensure that log storage buckets are not publicly accessible to prevent unauthorized access to sensitive log data. In addition, logs should be replicated to another cloud region to enhance availability, durability, and support disaster recovery requirements.", "Applicability": [ "tlp-red", "tlp-amber", "tlp-green" ], - "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access.\nRegularly review bucket permissions to ensure no public access has been inadvertently granted.\n", + "Recommendation": "Configure bucket policies and access control lists (ACLs) to restrict public access. Regularly review bucket permissions to ensure no public access has been inadvertently granted. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -2693,15 +1935,15 @@ ] }, { - "Id": "CCC.Logging.C06.TR01", - "Description": "When a single principal executes an anomalously high number of log queries,\nan alert MUST be generated.", + "Id": "CCC.Logging.CN06.AR01", + "Description": "When a single principal executes an anomalously high number of log queries, an alert MUST be generated.", "Attributes": [ { "FamilyName": "Logging and Monitoring", - "FamilyDescription": "Controls that collect, alert, and retain logging-related events.\n", - "Section": "CCC.Logging.C06 Detect and Alert on Potential Log Exfiltration", + "FamilyDescription": "Controls that collect, alert, and retain logging-related events. ", + "Section": "CCC.Logging.CN06 Detect and Alert on Potential Log Exfiltration", "SubSection": "", - "SubSectionObjective": "Identify and alert on anomalous data access patterns that may indicate an attempt\nto exfiltrate log data.", + "SubSectionObjective": "Identify and alert on anomalous data access patterns that may indicate an attempt to exfiltrate log data.", "Applicability": [ "tlp-green", "tlp-amber", @@ -2748,15 +1990,15 @@ ] }, { - "Id": "CCC.Logging.C07.TR01", - "Description": "When an audit log event is recorded that corresponds to a modification of the logging service\nconfiguration such as disabling a log trail, deleting a log sink, or altering a log forwarding rule,\nan alert MUST be generated.", + "Id": "CCC.Logging.CN07.AR01", + "Description": "When an audit log event is recorded that corresponds to a modification of the logging service configuration such as disabling a log trail, deleting a log sink, or altering a log forwarding rule, an alert MUST be generated.", "Attributes": [ { "FamilyName": "Logging and Monitoring", - "FamilyDescription": "Controls that collect, alert, and retain logging-related events.\n", - "Section": "CCC.Logging.C07 Detect and Alert on Log Service Tampering", + "FamilyDescription": "Controls that collect, alert, and retain logging-related events. ", + "Section": "CCC.Logging.CN07 Detect and Alert on Log Service Tampering", "SubSection": "", - "SubSectionObjective": "Alert when any component of the critical logging infrastructure is disabled, modified,\nor deleted, indicating a defense evasion attempt.", + "SubSectionObjective": "Alert when any component of the critical logging infrastructure is disabled, modified, or deleted, indicating a defense evasion attempt.", "Applicability": [ "tlp-clear", "tlp-green", @@ -2803,13 +2045,13 @@ ] }, { - "Id": "CCC.ObjStor.C01.TR01", + "Id": "CCC.ObjStor.CN01.AR01", "Description": "When a request is made to read a protected bucket, the service MUST prevent any request using KMS keys not listed as trusted by the organization.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C01 Prevent Unencrypted Requests", + "Section": "CCC.CN01 Prevent Unencrypted Requests", "SubSection": "CCC.ObjStor.C01 Prevent Requests to Buckets or Objects with Untrusted KMS Keys", "SubSectionObjective": "Prevent any requests to object storage buckets or objects using untrusted KMS keys to protect against unauthorized data encryption that can impact data availability and integrity.", "Applicability": [ @@ -2861,13 +2103,13 @@ ] }, { - "Id": "CCC.ObjStor.C01.TR02", + "Id": "CCC.ObjStor.CN01.AR02", "Description": "When a request is made to read a protected object, the service MUST prevent any request using KMS keys not listed as trusted by the organization.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C01 Prevent Unencrypted Requests", + "Section": "CCC.CN01 Prevent Unencrypted Requests", "SubSection": "CCC.ObjStor.C01 Prevent Requests to Buckets or Objects with Untrusted KMS Keys", "SubSectionObjective": "Prevent any requests to object storage buckets or objects using untrusted KMS keys to protect against unauthorized data encryption that can impact data availability and integrity.", "Applicability": [ @@ -2916,13 +2158,13 @@ "Checks": [] }, { - "Id": "CCC.ObjStor.C01.TR03", + "Id": "CCC.ObjStor.CN01.AR03", "Description": "When a request is made to write to a bucket, the service MUST prevent any request using KMS keys not listed as trusted by the organization.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C01 Prevent Unencrypted Requests", + "Section": "CCC.CN01 Prevent Unencrypted Requests", "SubSection": "CCC.ObjStor.C01 Prevent Requests to Buckets or Objects with Untrusted KMS Keys", "SubSectionObjective": "Prevent any requests to object storage buckets or objects using untrusted KMS keys to protect against unauthorized data encryption that can impact data availability and integrity.", "Applicability": [ @@ -2979,13 +2221,13 @@ ] }, { - "Id": "CCC.ObjStor.C01.TR04", + "Id": "CCC.ObjStor.CN01.AR04", "Description": "When a request is made to write to an object, the service MUST prevent any request using KMS keys not listed as trusted by the organization.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C01 Prevent Unencrypted Requests", + "Section": "CCC.CN01 Prevent Unencrypted Requests", "SubSection": "CCC.ObjStor.C01 Prevent Requests to Buckets or Objects with Untrusted KMS Keys", "SubSectionObjective": "Prevent any requests to object storage buckets or objects using untrusted KMS keys to protect against unauthorized data encryption that can impact data availability and integrity.", "Applicability": [ @@ -3043,13 +2285,13 @@ ] }, { - "Id": "CCC.ObjStor.C03.TR01", + "Id": "CCC.ObjStor.CN03.AR01", "Description": "When an object storage bucket deletion is attempted, the bucket MUST be fully recoverable for a set time-frame after deletion is requested.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C03 Implement Multi-factor Authentication (MFA) for Access", + "Section": "CCC.CN03 Implement Multi-factor Authentication (MFA) for Access", "SubSection": "CCC.ObjStor.C03 Prevent Bucket Deletion Through Irrevocable Bucket Retention Policy", "SubSectionObjective": "Ensure that object storage bucket is not deleted after creation, and that the preventative measure cannot be unset.", "Applicability": [ @@ -3101,13 +2343,13 @@ ] }, { - "Id": "CCC.ObjStor.C03.TR02", + "Id": "CCC.ObjStor.CN03.AR02", "Description": "When an attempt is made to modify the retention policy for an object storage bucket, the service MUST prevent the policy from being modified.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C03 Implement Multi-factor Authentication (MFA) for Access", + "Section": "CCC.CN03 Implement Multi-factor Authentication (MFA) for Access", "SubSection": "CCC.ObjStor.C03 Prevent Bucket Deletion Through Irrevocable Bucket Retention Policy", "SubSectionObjective": "Ensure that object storage bucket is not deleted after creation, and that the preventative measure cannot be unset.", "Applicability": [ @@ -3159,13 +2401,13 @@ ] }, { - "Id": "CCC.ObjStor.C04.TR01", + "Id": "CCC.ObjStor.CN04.AR01", "Description": "When an object is uploaded to the object storage system, the object MUST automatically receive a default retention policy that prevents premature deletion or modification.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C04 Log All Access and Changes", + "Section": "CCC.CN04 Log All Access and Changes", "SubSection": "CCC.ObjStor.C04 Objects have an Effective Retention Policy by Default", "SubSectionObjective": "Ensure that all objects stored in the object storage system have a retention policy applied by default, preventing premature deletion or modification of objects and ensuring compliance with data retention regulations.", "Applicability": [ @@ -3217,13 +2459,13 @@ ] }, { - "Id": "CCC.ObjStor.C04.TR02", + "Id": "CCC.ObjStor.CN04.AR02", "Description": "When an attempt is made to delete or modify an object that is subject to an active retention policy, the service MUST prevent the action from being completed.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C04 Log All Access and Changes", + "Section": "CCC.CN04 Log All Access and Changes", "SubSection": "CCC.ObjStor.C04 Objects have an Effective Retention Policy by Default", "SubSectionObjective": "Ensure that all objects stored in the object storage system have a retention policy applied by default, preventing premature deletion or modification of objects and ensuring compliance with data retention regulations.", "Applicability": [ @@ -3275,13 +2517,13 @@ ] }, { - "Id": "CCC.ObjStor.C05.TR01", + "Id": "CCC.ObjStor.CN05.AR01", "Description": "When an object is uploaded to the object storage bucket, the object MUST be stored with a unique identifier.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C05 Prevent Access from Untrusted Entities", + "Section": "CCC.CN05 Prevent Access from Untrusted Entities", "SubSection": "CCC.ObjStor.C05 Versioning is Enabled for All Objects in the Bucket", "SubSectionObjective": "Ensure that versioning is enabled for all objects stored in the object storage bucket to enable recovery of previous versions of objects in case of loss or corruption.", "Applicability": [ @@ -3331,13 +2573,13 @@ "Checks": [] }, { - "Id": "CCC.ObjStor.C05.TR02", + "Id": "CCC.ObjStor.CN05.AR02", "Description": "When an object is modified, the service MUST assign a new unique identifier to the modified object to differentiate it from the previous version.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C05 Prevent Access from Untrusted Entities", + "Section": "CCC.CN05 Prevent Access from Untrusted Entities", "SubSection": "CCC.ObjStor.C05 Versioning is Enabled for All Objects in the Bucket", "SubSectionObjective": "Ensure that versioning is enabled for all objects stored in the object storage bucket to enable recovery of previous versions of objects in case of loss or corruption.", "Applicability": [ @@ -3387,13 +2629,13 @@ "Checks": [] }, { - "Id": "CCC.ObjStor.C05.TR03", + "Id": "CCC.ObjStor.CN05.AR03", "Description": "When an object is modified, the service MUST allow for recovery of previous versions of the object.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C05 Prevent Access from Untrusted Entities", + "Section": "CCC.CN05 Prevent Access from Untrusted Entities", "SubSection": "CCC.ObjStor.C05 Versioning is Enabled for All Objects in the Bucket", "SubSectionObjective": "Ensure that versioning is enabled for all objects stored in the object storage bucket to enable recovery of previous versions of objects in case of loss or corruption.", "Applicability": [ @@ -3443,13 +2685,13 @@ "Checks": [] }, { - "Id": "CCC.ObjStor.C05.TR04", + "Id": "CCC.ObjStor.CN05.AR04", "Description": "When an object is deleted, the service MUST retain other versions of the object to allow for recovery of previous versions.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C05 Prevent Access from Untrusted Entities", + "Section": "CCC.CN05 Prevent Access from Untrusted Entities", "SubSection": "CCC.ObjStor.C05 Versioning is Enabled for All Objects in the Bucket", "SubSectionObjective": "Ensure that versioning is enabled for all objects stored in the object storage bucket to enable recovery of previous versions of objects in case of loss or corruption.", "Applicability": [ @@ -3499,13 +2741,13 @@ "Checks": [] }, { - "Id": "CCC.ObjStor.C06.TR01", + "Id": "CCC.ObjStor.CN06.AR01", "Description": "When an object storage bucket is accessed, the service MUST store access logs in a separate data store.", "Attributes": [ { "FamilyName": "Data", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C06 Prevent Deployment in Restricted Regions", + "Section": "CCC.CN06 Prevent Deployment in Restricted Regions", "SubSection": "CCC.ObjStor.C06 Access Logs are Stored in a Separate Data Store", "SubSectionObjective": "Ensure that access logs for object storage buckets are stored in a separate data store to protect against unauthorized access, tampering, or deletion of logs (Logbuckets are exempt from this requirement, but must be tlp-red).", "Applicability": [ @@ -3558,13 +2800,13 @@ ] }, { - "Id": "CCC.ObjStor.C02.TR01", + "Id": "CCC.ObjStor.CN02.AR01", "Description": "When a permission set is allowed for an object in a bucket, the service MUST allow the same permission set to access all objects in the same bucket.", "Attributes": [ { "FamilyName": "Identity and Access Management", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C02 Ensure Data Encryption at Rest for All Stored Data", + "Section": "CCC.CN02 Ensure Data Encryption at Rest for All Stored Data", "SubSection": "CCC.ObjStor.C02 Enforce Uniform Bucket-level Access to Prevent Inconsistent Permissions", "SubSectionObjective": "Ensure that uniform bucket-level access is enforced across all object storage buckets. This prevents the use of ad-hoc or inconsistent object-level permissions, ensuring centralized, consistent, and secure access management in accordance with the principle of least privilege.", "Applicability": [ @@ -3616,13 +2858,13 @@ ] }, { - "Id": "CCC.ObjStor.C02.TR02", + "Id": "CCC.ObjStor.CN02.AR02", "Description": "When a permission set is denied for an object in a bucket, the service MUST deny the same permission set to access all objects in the same bucket.", "Attributes": [ { "FamilyName": "Identity and Access Management", "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.C02 Ensure Data Encryption at Rest for All Stored Data", + "Section": "CCC.CN02 Ensure Data Encryption at Rest for All Stored Data", "SubSection": "CCC.ObjStor.C02 Enforce Uniform Bucket-level Access to Prevent Inconsistent Permissions", "SubSectionObjective": "Ensure that uniform bucket-level access is enforced across all object storage buckets. This prevents the use of ad-hoc or inconsistent object-level permissions, ensuring centralized, consistent, and secure access management in accordance with the principle of least privilege.", "Applicability": [ @@ -3673,982 +2915,9 @@ "cloudstorage_bucket_uniform_bucket_level_access" ] }, - { - "Id": "CCC.MLDE.CN01.AR01", - "Description": "Verify that only authorized users can access MLDE resources,\nand that access modes are properly defined and enforced.", - "Attributes": [ - { - "FamilyName": "Identity and Access Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN01 Define Access Mode for ML Development Environments", - "SubSection": "", - "SubSectionObjective": "Ensure that access to Machine Learning Development Environment (MLDE)\nresources is strictly defined and controlled.\nOnly authorized users with appropriate permissions can access these environments,\nmitigating the risk of unauthorized access, data leakage, or service disruption.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01", - "CCC.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-3" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.1.1", - "2013 A.9.2.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-2", - "AC-3" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-01", - "IAM-02" - ] - } - ] - } - ], - "Checks": [ - "iam_account_access_approval_enabled", - "iam_audit_logs_enabled", - "iam_no_service_roles_at_project_level", - "iam_role_kms_enforce_separation_of_duties", - "iam_role_sa_enforce_separation_of_duties", - "iam_sa_no_administrative_privileges", - "iam_sa_no_user_managed_keys", - "iam_sa_user_managed_key_rotate_90_days", - "iam_sa_user_managed_key_unused", - "iam_service_account_unused", - "gke_cluster_no_default_service_account", - "compute_instance_default_service_account_in_use", - "compute_instance_default_service_account_in_use_with_full_api_access" - ] - }, - { - "Id": "CCC.MLDE.CN03.AR01", - "Description": "Verify that root access is disabled on MLDE instances containing sensitive data.", - "Attributes": [ - { - "FamilyName": "Identity and Access Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN03 Disable Root Access on MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Prevent users from obtaining root access on MLDE instances to reduce the\nrisk of unauthorized system modifications and potential security breaches.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-4" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-6" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-08", - "IAM-12" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.2.3" - ] - } - ] - } - ], - "Checks": [ - "compute_project_os_login_enabled", - "compute_instance_block_project_wide_ssh_keys_disabled", - "compute_firewall_ssh_access_from_the_internet_allowed" - ] - }, - { - "Id": "CCC.MLDE.CN03.AR02", - "Description": "For MLDE instances without sensitive data, ensure that root access is only\nenabled when necessary and properly authorized.", - "Attributes": [ - { - "FamilyName": "Identity and Access Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN03 Disable Root Access on MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Prevent users from obtaining root access on MLDE instances to reduce the\nrisk of unauthorized system modifications and potential security breaches.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-4" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-6" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-08", - "IAM-12" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.2.3" - ] - } - ] - } - ], - "Checks": [ - "compute_firewall_ssh_access_from_the_internet_allowed", - "compute_firewall_rdp_access_from_the_internet_allowed", - "compute_instance_public_ip", - "compute_instance_block_project_wide_ssh_keys_disabled", - "compute_project_os_login_enabled", - "compute_instance_default_service_account_in_use", - "compute_instance_default_service_account_in_use_with_full_api_access", - "gke_cluster_no_default_service_account", - "iam_sa_no_administrative_privileges", - "iam_no_service_roles_at_project_level", - "iam_audit_logs_enabled" - ] - }, - { - "Id": "CCC.MLDE.CN04.AR01", - "Description": "Verify that terminal access is disabled on MLDE instances containing sensitive data.", - "Attributes": [ - { - "FamilyName": "Identity and Access Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN04 Disable Terminal Access on MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Prevent users from accessing the terminal on MLDE instances to limit the risk of\nunauthorized commands and potential system compromise.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-4" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-6" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-08" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.2.3" - ] - } - ] - } - ], - "Checks": [ - "compute_instance_serial_ports_in_use" - ] - }, - { - "Id": "CCC.MLDE.CN04.AR02", - "Description": "For MLDE instances without sensitive data, ensure that terminal access is only\nenabled when necessary and properly authorized.", - "Attributes": [ - { - "FamilyName": "Identity and Access Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN04 Disable Terminal Access on MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Prevent users from accessing the terminal on MLDE instances to limit the risk of\nunauthorized commands and potential system compromise.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-4" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-6" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-08" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.2.3" - ] - } - ] - } - ], - "Checks": [ - "compute_firewall_rdp_access_from_the_internet_allowed", - "compute_firewall_ssh_access_from_the_internet_allowed", - "compute_instance_serial_ports_in_use", - "compute_instance_public_ip" - ] - }, - { - "Id": "CCC.MLDE.CN02.AR01", - "Description": "Confirm that file download functionality is disabled on MLDE instances containing sensitive data.", - "Attributes": [ - { - "FamilyName": "Data Protection", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN02 Disable File Downloads on MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Prevent unauthorized file downloads from MLDE instances to protect sensitive data from being exfiltrated.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH02", - "CCC.TH02" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.DS-5" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "DSI-05", - "DSI-07" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.13.2.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-7", - "SC-8" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.MLDE.CN02.AR02", - "Description": "For MLDE instances without sensitive data, ensure that file downloads are monitored and logged.", - "Attributes": [ - { - "FamilyName": "Data Protection", - "FamilyDescription": "TODO: Describe this control family", - "Section": "", - "SubSection": "CCC.MLDE.CN02 Disable File Downloads on MLDE Instances", - "SubSectionObjective": "Prevent unauthorized file downloads from MLDE instances to protect sensitive data from being exfiltrated.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH02", - "CCC.TH02" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.DS-5" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "DSI-05", - "DSI-07" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.13.2.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-7", - "SC-8" - ] - } - ] - } - ], - "Checks": [ - "iam_audit_logs_enabled", - "logging_sink_created", - "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", - "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", - "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled", - "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled", - "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", - "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", - "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled", - "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled" - ] - }, - { - "Id": "CCC.MLDE.CN05.AR01", - "Description": "Verify that only approved VM and container images can be selected when creating MLDE instances.", - "Attributes": [ - { - "FamilyName": "Configuration Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "", - "SubSection": "CCC.MLDE.CN05 Restrict Environment Options on MLDE Instances", - "SubSectionObjective": "Limit the virtual machine and container image options available when creating\nnew MLDE instances to approved and secure configurations.", - "Applicability": [ - "tlp-red", - "tlp-amber" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH04" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.IP-1" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "TVM-02" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.12.5.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "CM-2" - ] - } - ] - } - ], - "Checks": [ - "artifacts_container_analysis_enabled", - "gcr_container_scanning_enabled" - ] - }, - { - "Id": "CCC.MLDE.CN05.AR02", - "Description": "Attempt to create an MLDE instance with an unapproved image and confirm that it is denied.", - "Attributes": [ - { - "FamilyName": "Configuration Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "", - "SubSection": "CCC.MLDE.CN05 Restrict Environment Options on MLDE Instances", - "SubSectionObjective": "Limit the virtual machine and container image options available when creating\nnew MLDE instances to approved and secure configurations.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH04" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.IP-1" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "TVM-02" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.12.5.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "CM-2" - ] - } - ] - } - ], - "Checks": [ - "artifacts_container_analysis_enabled", - "gcr_container_scanning_enabled", - "compute_instance_shielded_vm_enabled", - "compute_instance_confidential_computing_enabled", - "compute_instance_public_ip", - "compute_instance_ip_forwarding_is_enabled", - "compute_instance_default_service_account_in_use", - "compute_instance_serial_ports_in_use", - "compute_instance_block_project_wide_ssh_keys_disabled", - "compute_instance_encryption_with_csek_enabled", - "compute_firewall_ssh_access_from_the_internet_allowed", - "compute_firewall_rdp_access_from_the_internet_allowed" - ] - }, - { - "Id": "CCC.MLDE.CN06.AR01", - "Description": "Verify that automatic scheduled upgrades are enabled on user-managed\nMLDE instances containing sensitive data.", - "Attributes": [ - { - "FamilyName": "Vulnerability Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "", - "SubSection": "CCC.MLDE.CN06 Require Automatic Scheduled Upgrades on User-Managed MLDE Instances", - "SubSectionObjective": "Ensure that MLDE instances are kept up-to-date with the\nlatest security patches by enforcing automatic scheduled upgrades.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH04", - "CCC.TH06" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.IP-12" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "TVM-01", - "TVM-02" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.12.6.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SI-2" - ] - } - ] - } - ], - "Checks": [ - "artifacts_container_analysis_enabled", - "gcr_container_scanning_enabled" - ] - }, - { - "Id": "CCC.MLDE.CN06.AR02", - "Description": "Ensure that the upgrade schedule is appropriately configured and\ndoes not interfere with critical operations.", - "Attributes": [ - { - "FamilyName": "Vulnerability Management", - "FamilyDescription": "TODO: Describe this control family", - "Section": "", - "SubSection": "CCC.MLDE.CN06 Require Automatic Scheduled Upgrades on User-Managed MLDE Instances", - "SubSectionObjective": "Ensure that MLDE instances are kept up-to-date with the\nlatest security patches by enforcing automatic scheduled upgrades.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH04", - "CCC.TH06" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.IP-12" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "TVM-01", - "TVM-02" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.12.6.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SI-2" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.MLDE.CN07.AR01", - "Description": "Verify that MLDE instances containing sensitive data cannot be accessed via public IP addresses.", - "Attributes": [ - { - "FamilyName": "Network Security", - "FamilyDescription": "TODO: Describe this control family", - "Section": "", - "SubSection": "CCC.MLDE.CN07 Restrict Public IP Access on MLDE Instances", - "SubSectionObjective": "Prevent public IP access to MLDE instances to reduce exposure to the internet and enhance security.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH02", - "CCC.VPC.TH02" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-3" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "SEF-05" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.13.1.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-7" - ] - } - ] - } - ], - "Checks": [ - "compute_instance_public_ip", - "compute_firewall_rdp_access_from_the_internet_allowed", - "compute_firewall_ssh_access_from_the_internet_allowed" - ] - }, - { - "Id": "CCC.MLDE.CN07.AR02", - "Description": "For MLDE instances without sensitive data requiring public access,\nensure that appropriate security controls are in place and access is approved.", - "Attributes": [ - { - "FamilyName": "Network Security", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN07 Restrict Public IP Access on MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Prevent public IP access to MLDE instances to reduce exposure to the internet and enhance security.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH02", - "CCC.VPC.TH02" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-3" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "SEF-05" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.13.1.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-7" - ] - } - ] - } - ], - "Checks": [ - "compute_instance_public_ip", - "compute_firewall_rdp_access_from_the_internet_allowed", - "compute_firewall_ssh_access_from_the_internet_allowed", - "cloudsql_instance_public_ip", - "cloudsql_instance_private_ip_assignment", - "cloudsql_instance_public_access" - ] - }, - { - "Id": "CCC.MLDE.CN08.AR01", - "Description": "Verify that MLDE instances containing sensitive data can only be deployed in\napproved virtual networks with appropriate security controls.", - "Attributes": [ - { - "FamilyName": "Network Security", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN08 Restrict Virtual Networks for MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Limit the virtual networks that can be used when creating new MLDE instances to\nensure they are deployed within approved and secure network environments.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01", - "CCC.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-4" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-12" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.1.2" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-6" - ] - } - ] - } - ], - "Checks": [ - "compute_network_default_in_use", - "compute_network_not_legacy", - "compute_firewall_rdp_access_from_the_internet_allowed", - "compute_firewall_ssh_access_from_the_internet_allowed", - "compute_instance_public_ip", - "cloudsql_instance_public_ip", - "cloudsql_instance_private_ip_assignment", - "cloudsql_instance_public_access" - ] - }, - { - "Id": "CCC.MLDE.CN08.AR02", - "Description": "Ensure that MLDE instances without sensitive data are deployed in\nnetworks that meet organizational security standards.", - "Attributes": [ - { - "FamilyName": "Network Security", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.MLDE.CN08 Restrict Virtual Networks for MLDE Instances", - "SubSection": "", - "SubSectionObjective": "Limit the virtual networks that can be used when creating new MLDE instances to\nensure they are deployed within approved and secure network environments.", - "Applicability": [ - "tlp-red", - "tlp-amber", - "tlp-green", - "tlp-clear" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.MLDE.TH01", - "CCC.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-4" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "IAM-12" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.9.1.2" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-6" - ] - } - ] - } - ], - "Checks": [ - "compute_firewall_rdp_access_from_the_internet_allowed", - "compute_firewall_ssh_access_from_the_internet_allowed", - "compute_network_not_legacy", - "compute_network_default_in_use", - "compute_instance_public_ip", - "compute_instance_ip_forwarding_is_enabled", - "compute_instance_shielded_vm_enabled", - "compute_instance_serial_ports_in_use", - "cloudsql_instance_private_ip_assignment", - "cloudsql_instance_public_ip", - "cloudsql_instance_public_access", - "cloudstorage_bucket_public_access" - ] - }, - { - "Id": "CCC.Message.CN01.AR01", - "Description": "Attempt to publish a message without using a customer-managed encryption key\nand verify that the message is rejected or not stored.", - "Attributes": [ - { - "FamilyName": "Encryption", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.Message.CN01 Use Customer-Managed Encryption Keys (CMEK) for Messages", - "SubSection": "", - "SubSectionObjective": "Ensure that messages are encrypted using customer-managed encryption keys (CMEK)\nto provide enhanced control over encryption processes and keys, meeting compliance and security requirements.", - "Applicability": [ - "tlp-clear", - "tlp-green", - "tlp-amber", - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.DS-1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-12", - "SC-13" - ] - } - ] - } - ], - "Checks": [ - "dataproc_encrypted_with_cmks_disabled", - "compute_instance_encryption_with_csek_enabled", - "bigquery_dataset_cmk_encryption", - "bigquery_table_cmk_encryption", - "kms_key_not_publicly_accessible", - "kms_key_rotation_enabled" - ] - }, { "Id": "CCC.Monitor.CN01.AR01", - "Description": "When an External Monitoring system exceeds the anticipated rate of monitoring checks then\nRate Limiting MUST be applied and an Audit Alert MUST be generated.", + "Description": "When an External Monitoring system exceeds the anticipated rate of monitoring checks then Rate Limiting MUST be applied and an Audit Alert MUST be generated.", "Attributes": [ { "FamilyName": "Logging & Monitoring", @@ -4705,7 +2974,7 @@ }, { "Id": "CCC.Monitor.CN02.AR01", - "Description": "When an Custom or User-Defined Metric starts to flood a collector, then a rate limit MUST be applied\nto reduce the network impact of traffic and an alert must triggered.", + "Description": "When an Custom or User-Defined Metric starts to flood a collector, then a rate limit MUST be applied to reduce the network impact of traffic and an alert must triggered.", "Attributes": [ { "FamilyName": "Logging & Monitoring", @@ -4764,14 +3033,14 @@ }, { "Id": "CCC.Monitor.CN03.AR01", - "Description": "When external systems have approved access to internal systems not normally available for public access\nthen they MUST be secured to prevent unauthorised access jumping through to the internal systems and\nonly allow access to specific internal services.", + "Description": "When external systems have approved access to internal systems not normally available for public access then they MUST be secured to prevent unauthorised access jumping through to the internal systems and only allow access to specific internal services.", "Attributes": [ { "FamilyName": "Identity and Access Management", "FamilyDescription": "Controls designed to prevent unauthorised access to monitoring features.", "Section": "CCC.Monitor.CN03 Access External Monitoring", "SubSection": "", - "SubSectionObjective": "Control access to Synthetic monitoring solutions using API keys or Certificate based authentication to\nensure they don't become an attack path, preventing monitoring systems from forging network requests to\ngain access to internal systems.", + "SubSectionObjective": "Control access to Synthetic monitoring solutions using API keys or Certificate based authentication to ensure they don't become an attack path, preventing monitoring systems from forging network requests to gain access to internal systems.", "Applicability": [ "tlp-clear", "tlp-green", @@ -4813,7 +3082,7 @@ }, { "Id": "CCC.Monitor.CN04.AR01", - "Description": "When monitoring dashboards display degraded services which may become potential targets then the\ndashboard MUST be protected from unauthorised access.", + "Description": "When monitoring dashboards display degraded services which may become potential targets then the dashboard MUST be protected from unauthorised access.", "Attributes": [ { "FamilyName": "Identity and Access Management", @@ -4858,7 +3127,7 @@ }, { "Id": "CCC.Monitor.CN05.AR01", - "Description": "When monitoring services have generated an alert, the service MUST ensure only authorised\nresponders silence or acknowledge the alert.", + "Description": "When monitoring services have generated an alert, the service MUST ensure only authorised responders silence or acknowledge the alert.", "Attributes": [ { "FamilyName": "Identity and Access Management", @@ -4920,7 +3189,7 @@ "FamilyDescription": "Controls designed to prevent unauthorised access to monitoring features.", "Section": "CCC.Monitor.CN06 Metrics pushed for authorised services only", "SubSection": "", - "SubSectionObjective": "Use IAM to control which types of metrics or traces can be pushed by different system to avoid a compromised\nsystem pushing fabricated metrics about a different service", + "SubSectionObjective": "Use IAM to control which types of metrics or traces can be pushed by different system to avoid a compromised system pushing fabricated metrics about a different service", "Applicability": [ "tlp-clear", "tlp-green", @@ -4964,199 +3233,16 @@ "iam_service_account_unused" ] }, - { - "Id": "CCC.SecMgmt.CN01.AR01", - "Description": "Attempt to use an outdated version of a secret after its rotation period\nhas passed and verify that access is denied.", - "Attributes": [ - { - "FamilyName": "Data Protection", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.SecMgmt.CN01 Enforce Automatic Secret Rotation", - "SubSection": "", - "SubSectionObjective": "Ensure that secrets are automatically rotated on a defined schedule to\nreduce the risk of secret compromise and unauthorized access.", - "Applicability": [ - "tlp-red", - "tlp-amber" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.TH01", - "CCC.TH14" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.DS-6" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-12", - "SC-28" - ] - } - ] - } - ], - "Checks": [ - "apikeys_key_rotated_in_90_days", - "iam_sa_user_managed_key_rotate_90_days", - "kms_key_rotation_enabled" - ] - }, - { - "Id": "CCC.SecMgmt.CN02.AR01", - "Description": "Attempt to retrieve a secret from an unauthorized region and verify that access is denied.", - "Attributes": [ - { - "FamilyName": "Data Protection", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.SecMgmt.CN02 Enforce Secret Replication Policies", - "SubSection": "", - "SubSectionObjective": "Ensure that secrets are replicated only to authorized locations as per\norganizational data residency and compliance requirements.", - "Applicability": [ - "tlp-red", - "tlp-amber" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.TH03", - "CCC.TH04" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.DS-5" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-3", - "SC-7" - ] - } - ] - } - ], - "Checks": [] - }, - { - "Id": "CCC.SvlsComp.CN01.AR01", - "Description": "Attempt to access the serverless function over the public internet and verify that access is denied.", - "Attributes": [ - { - "FamilyName": "Network Security", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.SvlsComp.CN01 Enforce Use of Private Endpoints for Serverless Function", - "SubSection": "", - "SubSectionObjective": "Ensure that the serverless function is accessible only through a private endpoint,\nallowing it to communicate securely within a virtual private network and preventing\nunauthorized external access.", - "Applicability": [ - "tlp-red", - "tlp-amber" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.TH01" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-5" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-7", - "SC-8" - ] - } - ] - } - ], - "Checks": [ - "compute_firewall_rdp_access_from_the_internet_allowed", - "compute_firewall_ssh_access_from_the_internet_allowed", - "compute_instance_public_ip", - "cloudsql_instance_public_ip", - "cloudsql_instance_public_access", - "cloudsql_instance_private_ip_assignment", - "cloudstorage_bucket_public_access", - "bigquery_dataset_public_access", - "compute_public_address_shodan" - ] - }, - { - "Id": "CCC.SvlsComp.CN02.AR01", - "Description": "Send requests to invoke the function up to the allowed threshold and confirm they\nare successful; then send additional requests exceeding the threshold from the same\nentity and verify that they are denied.", - "Attributes": [ - { - "FamilyName": "Availability", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.SvlsComp.CN02 Implement Function Invocation Rate Limits", - "SubSection": "", - "SubSectionObjective": "Ensure that function invocation is limited to a specified threshold from any single entity,\npreventing resource exhaustion and denial of service attacks.", - "Applicability": [ - "tlp-red", - "tlp-amber" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.TH12" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.DS-4" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "SC-5" - ] - } - ] - } - ], - "Checks": [] - }, { "Id": "CCC.VPC.CN01.AR01", - "Description": "When a subscription is created, the subscription MUST NOT\ncontain default network resources.", + "Description": "When a subscription is created, the subscription MUST NOT contain default network resources.", "Attributes": [ { "FamilyName": "Network Security", "FamilyDescription": "TODO: Describe this control family", "Section": "CCC.VPC.CN01 Restrict Default Network Creation", "SubSection": "", - "SubSectionObjective": "Restrict the automatic creation of default virtual networks and related\nresources during subscription initialization to avoid insecure default\nconfigurations and enforce custom network policies.", + "SubSectionObjective": "Restrict the automatic creation of default virtual networks and related resources during subscription initialization to avoid insecure default configurations and enforce custom network policies.", "Applicability": [ "tlp-amber", "tlp-red" @@ -5202,74 +3288,16 @@ "compute_network_default_in_use" ] }, - { - "Id": "CCC.VPC.CN02.AR01", - "Description": "When a resource is created in a public subnet, that resource\nMUST NOT be assigned an external IP address by default.", - "Attributes": [ - { - "FamilyName": "Network Security", - "FamilyDescription": "TODO: Describe this control family", - "Section": "CCC.VPC.CN02 Limit Resource Creation in Public Subnet", - "SubSection": "", - "SubSectionObjective": "Restrict the creation of resources in the public subnet with\ndirect access to the internet to minimize attack surfaces.", - "Applicability": [ - "tlp-red" - ], - "Recommendation": "", - "SectionThreatMappings": [ - { - "ReferenceId": "CCC", - "Identifiers": [ - "CCC.VPC.TH02" - ] - } - ], - "SectionGuidelineMappings": [ - { - "ReferenceId": "NIST-CSF", - "Identifiers": [ - "PR.AC-3" - ] - }, - { - "ReferenceId": "CCM", - "Identifiers": [ - "SEF-05" - ] - }, - { - "ReferenceId": "ISO_27001", - "Identifiers": [ - "2013 A.13.1.1" - ] - }, - { - "ReferenceId": "NIST_800_53", - "Identifiers": [ - "AC-4" - ] - } - ] - } - ], - "Checks": [ - "compute_firewall_rdp_access_from_the_internet_allowed", - "compute_firewall_ssh_access_from_the_internet_allowed", - "compute_instance_public_ip", - "cloudsql_instance_public_ip", - "cloudsql_instance_public_access" - ] - }, { "Id": "CCC.VPC.CN03.AR01", - "Description": "When a VPC peering connection is requested, the service MUST\nprevent connections from VPCs that are not explicitly\nallowed.", + "Description": "When a VPC peering connection is requested, the service MUST prevent connections from VPCs that are not explicitly allowed.", "Attributes": [ { "FamilyName": "Network Security", "FamilyDescription": "TODO: Describe this control family", "Section": "CCC.VPC.CN03 Restrict VPC Peering to Authorized Accounts", "SubSection": "", - "SubSectionObjective": "Ensure VPC peering connections are only established with explicitly\nauthorized destinations to limit network exposure and enforce boundary\ncontrols.", + "SubSectionObjective": "Ensure VPC peering connections are only established with explicitly authorized destinations to limit network exposure and enforce boundary controls.", "Applicability": [ "tlp-green", "tlp-amber", @@ -5316,14 +3344,14 @@ }, { "Id": "CCC.VPC.CN04.AR01", - "Description": "When any network traffic goes to or from an interface in the VPC,\nthe service MUST capture and log all relevant information.", + "Description": "When any network traffic goes to or from an interface in the VPC, the service MUST capture and log all relevant information.", "Attributes": [ { "FamilyName": "Network Security", "FamilyDescription": "TODO: Describe this control family", "Section": "CCC.VPC.CN04 Enforce VPC Flow Logs on VPCs", "SubSection": "", - "SubSectionObjective": "Ensure VPCs are configured with flow logs enabled to capture traffic\ninformation.", + "SubSectionObjective": "Ensure VPCs are configured with flow logs enabled to capture traffic information.", "Applicability": [ "tlp-amber", "tlp-red" @@ -5371,14 +3399,14 @@ }, { "Id": "CCC.Vector.CN01.AR01", - "Description": "When a vector embedding is submitted for indexing, the system MUST validate that it\nmatches expected schema, dimension, and format profiles.", + "Description": "When a vector embedding is submitted for indexing, the system MUST validate that it matches expected schema, dimension, and format profiles.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN01 Validate Embeddings Before Indexing", "SubSection": "", - "SubSectionObjective": "Ensure all incoming embeddings are structurally and statistically validated\nbefore indexing to prevent poisoning or corruption.", + "SubSectionObjective": "Ensure all incoming embeddings are structurally and statistically validated before indexing to prevent poisoning or corruption.", "Applicability": [ "tlp-clear", "tlp-green", @@ -5410,14 +3438,14 @@ }, { "Id": "CCC.Vector.CN02.AR01", - "Description": "When an index lifecycle event is triggered, the service MUST\nverify that the actor has explicit permissions for the operation type.", + "Description": "When an index lifecycle event is triggered, the service MUST verify that the actor has explicit permissions for the operation type.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN02 Enforce Role-Based Index Lifecycle Management", "SubSection": "", - "SubSectionObjective": "Restrict index lifecycle operations (create, delete, rollback) to privileged\nidentities using fine-grained access controls.", + "SubSectionObjective": "Restrict index lifecycle operations (create, delete, rollback) to privileged identities using fine-grained access controls.", "Applicability": [ "tlp-clear", "tlp-green", @@ -5455,14 +3483,14 @@ }, { "Id": "CCC.Vector.CN03.AR01", - "Description": "When a metadata filter is applied to a query, the service MUST\nverify the requester is authorized to access that field.", + "Description": "When a metadata filter is applied to a query, the service MUST verify the requester is authorized to access that field.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN03 Enforce Metadata-Level Access Controls", "SubSection": "", - "SubSectionObjective": "Apply access control policies to metadata fields used in filtering to\nprevent unauthorized exposure or inference.", + "SubSectionObjective": "Apply access control policies to metadata fields used in filtering to prevent unauthorized exposure or inference.", "Applicability": [ "tlp-amber", "tlp-red" @@ -5489,28 +3517,18 @@ ] } ], - "Checks": [ - "iam_audit_logs_enabled", - "iam_account_access_approval_enabled", - "iam_no_service_roles_at_project_level", - "iam_role_sa_enforce_separation_of_duties", - "iam_sa_no_administrative_privileges", - "cloudstorage_bucket_public_access", - "cloudstorage_bucket_uniform_bucket_level_access", - "iam_cloud_asset_inventory_enabled", - "compute_instance_default_service_account_in_use" - ] + "Checks": [] }, { "Id": "CCC.Vector.CN04.AR01", - "Description": "When ingestion exceeds pre-defined thresholds, the service MUST\nthrottle or reject excess vector write operations.", + "Description": "When ingestion exceeds pre-defined thresholds, the service MUST throttle or reject excess vector write operations.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN04 Enforce Ingestion Quotas and Throttling", "SubSection": "", - "SubSectionObjective": "Prevent ingestion-based DoS or index pollution by\nrate-limiting vector submissions and enforcing quotas.", + "SubSectionObjective": "Prevent ingestion-based DoS or index pollution by rate-limiting vector submissions and enforcing quotas.", "Applicability": [ "tlp-green", "tlp-amber", @@ -5540,14 +3558,14 @@ }, { "Id": "CCC.Vector.CN05.AR01", - "Description": "When a rollback is attempted, the system MUST log\nthe action and verify rollback authorization.", + "Description": "When a rollback is attempted, the system MUST log the action and verify rollback authorization.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN05 Enforce Index Versioning with Rollback Protection", "SubSection": "", - "SubSectionObjective": "Ensure vector indexes are versioned and that rollback\noperations are authorized and auditable.", + "SubSectionObjective": "Ensure vector indexes are versioned and that rollback operations are authorized and auditable.", "Applicability": [ "tlp-amber", "tlp-red" @@ -5588,14 +3606,14 @@ }, { "Id": "CCC.Vector.CN06.AR01", - "Description": "When an embedding is submitted, the service MUST validate\nthat its format and dimensionality match allowed profiles.", + "Description": "When an embedding is submitted, the service MUST validate that its format and dimensionality match allowed profiles.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN06 Enforce Dimensional and Format Constraints", "SubSection": "", - "SubSectionObjective": "Reject embeddings that do not conform to expected model\nspecifications (dimensions, format, etc).", + "SubSectionObjective": "Reject embeddings that do not conform to expected model specifications (dimensions, format, etc).", "Applicability": [ "tlp-clear", "tlp-green", @@ -5626,14 +3644,14 @@ }, { "Id": "CCC.Vector.CN07.AR01", - "Description": "When a search request is issued, clients MUST be allowed\nto declare their requirement for exact vs approximate results.", + "Description": "When a search request is issued, clients MUST be allowed to declare their requirement for exact vs approximate results.", "Attributes": [ { "FamilyName": "Vector Indexing", "FamilyDescription": "Controls specific to the management and protection of vector embedding and index operations.", "Section": "CCC.Vector.CN07 Support Explicit ANN vs. Exact Search Configuration", "SubSection": "", - "SubSectionObjective": "Provide clients with the option to enforce exact-match\n(non-ANN) search where search fidelity is critical.", + "SubSectionObjective": "Provide clients with the option to enforce exact-match (non-ANN) search where search fidelity is critical.", "Applicability": [ "tlp-amber", "tlp-red" @@ -5654,20 +3672,20 @@ }, { "Id": "CCC.Core.CN01.AR01", - "Description": "When a port is exposed for non-SSH network traffic, all traffic\nMUST include a TLS handshake AND be encrypted using TLS 1.3 or\nhigher.", + "Description": "When a port is exposed for non-SSH network traffic, all traffic MUST include a TLS handshake AND be encrypted using TLS 1.3 or higher.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN01 Encrypt Data for Transmission", "SubSection": "", - "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect\ndata integrity and confidentiality.", + "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect data integrity and confidentiality.", "Applicability": [ "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Most cloud services enable TLS 1.3 by default. Where it is not\nalready set, ensure that your services are configured or updated\naccordingly.\n", + "Recommendation": "Most cloud services enable TLS 1.3 by default. Where it is not already set, ensure that your services are configured or updated accordingly. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -5714,21 +3732,21 @@ }, { "Id": "CCC.Core.CN01.AR02", - "Description": "When a port is exposed for SSH network traffic, all traffic MUST\ninclude a SSH handshake AND be encrypted using SSHv2 or higher.", + "Description": "When a port is exposed for SSH network traffic, all traffic MUST include a SSH handshake AND be encrypted using SSHv2 or higher.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN01 Encrypt Data for Transmission", "SubSection": "", - "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect\ndata integrity and confidentiality.", + "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect data integrity and confidentiality.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Any time port 22 is exposed, ensure that it has a properly\nimplemented SSH server with SSHv2 enabled and configured with\nstrong ciphers.\n", + "Recommendation": "Any time port 22 is exposed, ensure that it has a properly implemented SSH server with SSHv2 enabled and configured with strong ciphers. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -5775,20 +3793,20 @@ }, { "Id": "CCC.Core.CN01.AR03", - "Description": "When the service receives unencrypted traffic, \nthen it MUST either block the request or automatically\nredirect it to the secure equivalent.", + "Description": "When the service receives unencrypted traffic, then it MUST either block the request or automatically redirect it to the secure equivalent.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN01 Encrypt Data for Transmission", "SubSection": "", - "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect\ndata integrity and confidentiality.", + "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect data integrity and confidentiality.", "Applicability": [ "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Review firewall, load balancer, and application configurations to\nensure insecure protocols such as HTTP, FTP, and Telnet are not\nexposed. Where possible, implement automatic redirection to secure\nprotocols such as HTTPS, SFTP, SSH, and regularly scan for\nprotocol drift.\n", + "Recommendation": "Review firewall, load balancer, and application configurations to ensure insecure protocols such as HTTP, FTP, and Telnet are not exposed. Where possible, implement automatic redirection to secure protocols such as HTTPS, SFTP, SSH, and regularly scan for protocol drift. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -5841,21 +3859,21 @@ }, { "Id": "CCC.Core.CN01.AR07", - "Description": "When a port is exposed, the service MUST ensure that the protocol\nand service officially assigned to that port number by the IANA\nService Name and Transport Protocol Port Number Registry, and no\nother, is run on that port.", + "Description": "When a port is exposed, the service MUST ensure that the protocol and service officially assigned to that port number by the IANA Service Name and Transport Protocol Port Number Registry, and no other, is run on that port.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN01 Encrypt Data for Transmission", "SubSection": "", - "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect\ndata integrity and confidentiality.", + "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect data integrity and confidentiality.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Reference the IANA Service Name and Transport Protocol Port Number\nRegistry for more information about correct protocol-to-port\nassignments. Avoid running non-standard services on well-known\nports.\n", + "Recommendation": "Reference the IANA Service Name and Transport Protocol Port Number Registry for more information about correct protocol-to-port assignments. Avoid running non-standard services on well-known ports. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -5903,19 +3921,19 @@ }, { "Id": "CCC.Core.CN01.AR08", - "Description": "When a service transmits data using TLS, mutual TLS (mTLS) MUST be\nimplemented to require both client and server certificate\nauthentication for all connections.", + "Description": "When a service transmits data using TLS, mutual TLS (mTLS) MUST be implemented to require both client and server certificate authentication for all connections.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN01 Encrypt Data for Transmission", "SubSection": "", - "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect\ndata integrity and confidentiality.", + "SubSectionObjective": "Ensure that all communications are encrypted in transit to protect data integrity and confidentiality.", "Applicability": [ "tlp-amber", "tlp-red" ], - "Recommendation": "Configure mTLS for all endpoints that process or transmit\nsensitive data. Ensure both client and server certificates are\nvalidated and managed securely. Regularly review certificate\nauthorities and automate certificate rotation where possible.\n", + "Recommendation": "Configure mTLS for all endpoints that process or transmit sensitive data. Ensure both client and server certificates are validated and managed securely. Regularly review certificate authorities and automate certificate rotation where possible. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -5962,21 +3980,21 @@ }, { "Id": "CCC.Core.CN13.AR01", - "Description": "When a port is exposed that uses certificate-based encryption,\nthe service MUST only use valid, unexpired certificates issued by\na trusted certificate authority.", + "Description": "When a port is exposed that uses certificate-based encryption, the service MUST only use valid, unexpired certificates issued by a trusted certificate authority.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN13 Minimize Lifetime of Encryption and Authentication Certificates", "SubSection": "", - "SubSectionObjective": "Ensure that encryption and authentication certificates have a limited\nlifetime to reduce the risk of compromise and ensure the use of\nup-to-date security practices.", + "SubSectionObjective": "Ensure that encryption and authentication certificates have a limited lifetime to reduce the risk of compromise and ensure the use of up-to-date security practices.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Track certificate expiration dates and automate certificate\nrenewal where possible. Use certificate management tools to ensure\nonly certificates from trusted authorities are deployed.\n", + "Recommendation": "Track certificate expiration dates and automate certificate renewal where possible. Use certificate management tools to ensure only certificates from trusted authorities are deployed. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -5992,18 +4010,18 @@ }, { "Id": "CCC.Core.CN13.AR02", - "Description": "When a port is exposed that uses certificate-based encryption,\nthe service MUST rotate active certificates within 180 days of\nissuance.", + "Description": "When a port is exposed that uses certificate-based encryption, the service MUST rotate active certificates within 180 days of issuance.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN13 Minimize Lifetime of Encryption and Authentication Certificates", "SubSection": "", - "SubSectionObjective": "Ensure that encryption and authentication certificates have a limited\nlifetime to reduce the risk of compromise and ensure the use of\nup-to-date security practices.", + "SubSectionObjective": "Ensure that encryption and authentication certificates have a limited lifetime to reduce the risk of compromise and ensure the use of up-to-date security practices.", "Applicability": [ "tlp-amber" ], - "Recommendation": "Track certificate expiration dates and automate certificate\nrenewal where possible. Use certificate management tools to ensure\nonly certificates from trusted authorities are deployed.\n", + "Recommendation": "Track certificate expiration dates and automate certificate renewal where possible. Use certificate management tools to ensure only certificates from trusted authorities are deployed. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6019,18 +4037,18 @@ }, { "Id": "CCC.Core.CN13.AR03", - "Description": "When a port is exposed that uses certificate-based encryption,\nthe service MUST rotate active certificates within 90 days of\nissuance.", + "Description": "When a port is exposed that uses certificate-based encryption, the service MUST rotate active certificates within 90 days of issuance.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN13 Minimize Lifetime of Encryption and Authentication Certificates", "SubSection": "", - "SubSectionObjective": "Ensure that encryption and authentication certificates have a limited\nlifetime to reduce the risk of compromise and ensure the use of\nup-to-date security practices.", + "SubSectionObjective": "Ensure that encryption and authentication certificates have a limited lifetime to reduce the risk of compromise and ensure the use of up-to-date security practices.", "Applicability": [ "tlp-red" ], - "Recommendation": "Track certificate expiration dates and automate certificate\nrenewal where possible. Use certificate management tools to ensure\nonly certificates from trusted authorities are deployed.\n", + "Recommendation": "Track certificate expiration dates and automate certificate renewal where possible. Use certificate management tools to ensure only certificates from trusted authorities are deployed. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6049,21 +4067,21 @@ }, { "Id": "CCC.Core.CN06.AR01", - "Description": "When the service is running, its region and availability zone MUST\nbe included in a list of explicitly trusted or approved locations\nwithin the trust perimeter.", + "Description": "When the service is running, its region and availability zone MUST be included in a list of explicitly trusted or approved locations within the trust perimeter.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN06 Restrict Deployments to Trust Perimeter", "SubSection": "", - "SubSectionObjective": "Ensure that the service and its child resources are only deployed on\ninfrastructure in locations that are explicitly included within a\ndefined trust perimeter.", + "SubSectionObjective": "Ensure that the service and its child resources are only deployed on infrastructure in locations that are explicitly included within a defined trust perimeter.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Maintain an up-to-date list of trusted and approved regions based\non organizational policies. Validate the service's deployment\nlocation is included in this list.\n", + "Recommendation": "Maintain an up-to-date list of trusted and approved regions based on organizational policies. Validate the service's deployment location is included in this list. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6104,21 +4122,21 @@ }, { "Id": "CCC.Core.CN06.AR02", - "Description": "When a child resource is deployed, its region and availability\nzone MUST be included in a list of explicitly trusted or approved\nlocations within the trust perimeter.", + "Description": "When a child resource is deployed, its region and availability zone MUST be included in a list of explicitly trusted or approved locations within the trust perimeter.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN06 Restrict Deployments to Trust Perimeter", "SubSection": "", - "SubSectionObjective": "Ensure that the service and its child resources are only deployed on\ninfrastructure in locations that are explicitly included within a\ndefined trust perimeter.", + "SubSectionObjective": "Ensure that the service and its child resources are only deployed on infrastructure in locations that are explicitly included within a defined trust perimeter.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Maintain an up-to-date list of trusted and approved regions based\non organizational policies. Validate that child resources can only\nbe deployed to locations included in this list.\n", + "Recommendation": "Maintain an up-to-date list of trusted and approved regions based on organizational policies. Validate that child resources can only be deployed to locations included in this list. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6159,20 +4177,20 @@ }, { "Id": "CCC.Core.CN08.AR01", - "Description": "When data is created or modified, the data MUST have a complete\nand recoverable duplicate that is stored in a physically separate\ndata center.", + "Description": "When data is created or modified, the data MUST have a complete and recoverable duplicate that is stored in a physically separate data center.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN08 Replicate Data to Multiple Locations", "SubSection": "", - "SubSectionObjective": "Ensure that data is replicated across multiple physical locations to\nprotect against data loss due to hardware failures, natural disasters,\nor other catastrophic events.", + "SubSectionObjective": "Ensure that data is replicated across multiple physical locations to protect against data loss due to hardware failures, natural disasters, or other catastrophic events.", "Applicability": [ "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Implement automated data replication processes to ensure that\ndata is consistently duplicated in another region or availability\nzone. Regularly test data recovery from the replicated location to\nensure integrity and availability.\n", + "Recommendation": "Implement automated data replication processes to ensure that data is consistently duplicated in another region or availability zone. Regularly test data recovery from the replicated location to ensure integrity and availability. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6213,14 +4231,14 @@ }, { "Id": "CCC.Core.CN08.AR02", - "Description": "When data is replicated into a second location, the service MUST\nbe able to accurately represent the replication locations,\nreplication status, and data synchronization status.", + "Description": "When data is replicated into a second location, the service MUST be able to accurately represent the replication locations, replication status, and data synchronization status.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN08 Replicate Data to Multiple Locations", "SubSection": "", - "SubSectionObjective": "Ensure that data is replicated across multiple physical locations to\nprotect against data loss due to hardware failures, natural disasters,\nor other catastrophic events.", + "SubSectionObjective": "Ensure that data is replicated across multiple physical locations to protect against data loss due to hardware failures, natural disasters, or other catastrophic events.", "Applicability": [ "tlp-green", "tlp-amber", @@ -6264,14 +4282,14 @@ }, { "Id": "CCC.Core.CN09.AR01", - "Description": "When the service is operational, its logs and any child resource\nlogs MUST NOT be accessible from the resource they record access\nto.", + "Description": "When the service is operational, its logs and any child resource logs MUST NOT be accessible from the resource they record access to.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN09 Ensure Integrity of Access Logs", "SubSection": "", - "SubSectionObjective": "Ensure that access logs are always recorded to an external location\nthat cannot be manipulated from the context of the service(s) it\ncontains logs for.", + "SubSectionObjective": "Ensure that access logs are always recorded to an external location that cannot be manipulated from the context of the service(s) it contains logs for.", "Applicability": [ "tlp-clear", "tlp-green", @@ -6321,21 +4339,21 @@ }, { "Id": "CCC.Core.CN09.AR02", - "Description": "When the service is operational, disabling the logs for the service\nor its child resources MUST NOT be possible without also disabling\nthe corresponding resource.", + "Description": "When the service is operational, disabling the logs for the service or its child resources MUST NOT be possible without also disabling the corresponding resource.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN09 Ensure Integrity of Access Logs", "SubSection": "", - "SubSectionObjective": "Ensure that access logs are always recorded to an external location\nthat cannot be manipulated from the context of the service(s) it\ncontains logs for.", + "SubSectionObjective": "Ensure that access logs are always recorded to an external location that cannot be manipulated from the context of the service(s) it contains logs for.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "No normal business operations should disable\nlogs, as this could indicate an attempt to cover up unauthorized\naccess. Ensure that logging mechanisms are tightly integrated with\nservice operations, so that logging cannot be disabled without\nstopping the service itself.\n", + "Recommendation": "No normal business operations should disable logs, as this could indicate an attempt to cover up unauthorized access. Ensure that logging mechanisms are tightly integrated with service operations, so that logging cannot be disabled without stopping the service itself. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6381,19 +4399,19 @@ }, { "Id": "CCC.Core.CN09.AR03", - "Description": "When the service is operational, any attempt to redirect logs for\nthe service or its child resources MUST NOT be possible without\nhalting operation of the corresponding resource and publishing\ncorresponding events to monitored channels.", + "Description": "When the service is operational, any attempt to redirect logs for the service or its child resources MUST NOT be possible without halting operation of the corresponding resource and publishing corresponding events to monitored channels.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN09 Ensure Integrity of Access Logs", "SubSection": "", - "SubSectionObjective": "Ensure that access logs are always recorded to an external location\nthat cannot be manipulated from the context of the service(s) it\ncontains logs for.", + "SubSectionObjective": "Ensure that access logs are always recorded to an external location that cannot be manipulated from the context of the service(s) it contains logs for.", "Applicability": [ "tlp-amber", "tlp-red" ], - "Recommendation": "No normal business operations should result in the redirection of\nlogs, as this could indicate an attempt to cover up unauthorized\naccess. Ensure that logging configurations are immutable during\nservice operation so that any changes require stopping the service\nand publishing corresponding events to monitored channels.\n", + "Recommendation": "No normal business operations should result in the redirection of logs, as this could indicate an attempt to cover up unauthorized access. Ensure that logging configurations are immutable during service operation so that any changes require stopping the service and publishing corresponding events to monitored channels. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6435,14 +4453,14 @@ }, { "Id": "CCC.Core.CN10.AR01", - "Description": "When data is replicated, the service MUST ensure that replication\nonly occurs to destinations that are explicitly included within\nthe defined trust perimeter.", + "Description": "When data is replicated, the service MUST ensure that replication only occurs to destinations that are explicitly included within the defined trust perimeter.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN10 Restrict Data Replication to Trust Perimeter", "SubSection": "", - "SubSectionObjective": "Ensure that data is only replicated on infrastructure in locations\nthat are explicitly included within a defined trust perimeter.", + "SubSectionObjective": "Ensure that data is only replicated on infrastructure in locations that are explicitly included within a defined trust perimeter.", "Applicability": [ "tlp-green", "tlp-amber", @@ -6484,14 +4502,14 @@ }, { "Id": "CCC.Core.CN02.AR01", - "Description": "When data is stored, it MUST be encrypted using the latest\nindustry-standard encryption methods.", + "Description": "When data is stored, it MUST be encrypted using the latest industry-standard encryption methods.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN02 Encrypt Data for Storage", "SubSection": "", - "SubSectionObjective": "Ensure that all data stored is encrypted at rest using strong\nencryption algorithms.", + "SubSectionObjective": "Ensure that all data stored is encrypted at rest using strong encryption algorithms.", "Applicability": [ "tlp-green", "tlp-amber", @@ -6543,14 +4561,14 @@ }, { "Id": "CCC.Core.CN11.AR01", - "Description": "When encryption keys are used, the service MUST verify that\nall encryption keys use the latest industry-standard cryptographic\nalgorithms.", + "Description": "When encryption keys are used, the service MUST verify that all encryption keys use the latest industry-standard cryptographic algorithms.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN11 Protect Encryption Keys", "SubSection": "", - "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing\nthe use of approved algorithms, regular key rotation, and\ncustomer-managed encryption keys (CMEKs).", + "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).", "Applicability": [ "tlp-amber", "tlp-red" @@ -6605,14 +4623,14 @@ }, { "Id": "CCC.Core.CN11.AR02", - "Description": "When encryption keys are used, the service MUST rotate active keys\nwithin 180 days of issuance.", + "Description": "When encryption keys are used, the service MUST rotate active keys within 180 days of issuance.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN11 Protect Encryption Keys", "SubSection": "", - "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing\nthe use of approved algorithms, regular key rotation, and\ncustomer-managed encryption keys (CMEKs).", + "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).", "Applicability": [ "tlp-amber" ], @@ -6666,14 +4684,14 @@ }, { "Id": "CCC.Core.CN11.AR03", - "Description": "When encrypting data, the service MUST verify that\ncustomer-managed encryption keys (CMEKs) are used.", + "Description": "When encrypting data, the service MUST verify that customer-managed encryption keys (CMEKs) are used.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "", "SubSection": "CCC.Core.CN11 Protect Encryption Keys", - "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing\nthe use of approved algorithms, regular key rotation, and\ncustomer-managed encryption keys (CMEKs).", + "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).", "Applicability": [ "tlp-amber", "tlp-red" @@ -6728,14 +4746,14 @@ }, { "Id": "CCC.Core.CN11.AR04", - "Description": "When encryption keys are accessed, the service MUST verify that\naccess to encryption keys is restricted to authorized personnel\nand services, following the principle of least privilege.", + "Description": "When encryption keys are accessed, the service MUST verify that access to encryption keys is restricted to authorized personnel and services, following the principle of least privilege.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN11 Protect Encryption Keys", "SubSection": "", - "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing\nthe use of approved algorithms, regular key rotation, and\ncustomer-managed encryption keys (CMEKs).", + "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).", "Applicability": [ "tlp-clear", "tlp-green", @@ -6792,14 +4810,14 @@ }, { "Id": "CCC.Core.CN11.AR05", - "Description": "When encryption keys are used, the service MUST rotate active keys\nwithin 365 days of issuance.", + "Description": "When encryption keys are used, the service MUST rotate active keys within 365 days of issuance.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN11 Protect Encryption Keys", "SubSection": "", - "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing\nthe use of approved algorithms, regular key rotation, and\ncustomer-managed encryption keys (CMEKs).", + "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).", "Applicability": [ "tlp-clear", "tlp-green" @@ -6854,14 +4872,14 @@ }, { "Id": "CCC.Core.CN11.AR06", - "Description": "When encryption keys are used, the service MUST rotate active keys\nwithin 90 days of issuance.", + "Description": "When encryption keys are used, the service MUST rotate active keys within 90 days of issuance.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN11 Protect Encryption Keys", "SubSection": "", - "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing\nthe use of approved algorithms, regular key rotation, and\ncustomer-managed encryption keys (CMEKs).", + "SubSectionObjective": "Ensure that encryption keys are managed securely by enforcing the use of approved algorithms, regular key rotation, and customer-managed encryption keys (CMEKs).", "Applicability": [ "tlp-red" ], @@ -6915,21 +4933,21 @@ }, { "Id": "CCC.Core.CN14.AR01", - "Description": "When backups are created for disaster recovery purposes, the\nstorage mechanism MUST NOT allow modification or deletion\nwithin 30 days of creation.", + "Description": "When backups are created for disaster recovery purposes, the storage mechanism MUST NOT allow modification or deletion within 30 days of creation.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN14 Maintain Recent Backups", "SubSection": "", - "SubSectionObjective": "Ensure that all backups used for disaster recovery are recent and\nsubject to a retention policy that limits deletion.", + "SubSectionObjective": "Ensure that all backups used for disaster recovery are recent and subject to a retention policy that limits deletion.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Use immutable storage solutions where possible. Implement backup\nretention policies that enforce a minimum retention period of 30\ndays.\n", + "Recommendation": "Use immutable storage solutions where possible. Implement backup retention policies that enforce a minimum retention period of 30 days. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6948,20 +4966,20 @@ }, { "Id": "CCC.Core.CN14.AR02", - "Description": "When backups are created for disaster recovery purposes, the\nmost recent backup MUST have a creation date within the past\n30 days.", + "Description": "When backups are created for disaster recovery purposes, the most recent backup MUST have a creation date within the past 30 days.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN14 Maintain Recent Backups", "SubSection": "", - "SubSectionObjective": "Ensure that all backups used for disaster recovery are recent and\nsubject to a retention policy that limits deletion.", + "SubSectionObjective": "Ensure that all backups used for disaster recovery are recent and subject to a retention policy that limits deletion.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber" ], - "Recommendation": "Implement automated backup processes to ensure that backups are\ncreated regularly. Monitor backup schedules and verify that the\nmost recent backup creation date is within the last 30 days.\n", + "Recommendation": "Implement automated backup processes to ensure that backups are created regularly. Monitor backup schedules and verify that the most recent backup creation date is within the last 30 days. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -6979,18 +4997,18 @@ }, { "Id": "CCC.Core.CN14.AR02", - "Description": "When backups are created for disaster recovery purposes, the\nmost recent backup MUST have a creation date within the past\n14 days.", + "Description": "When backups are created for disaster recovery purposes, the most recent backup MUST have a creation date within the past 14 days.", "Attributes": [ { "FamilyName": "Data", - "FamilyDescription": "The Data control family ensures the confidentiality, integrity,\navailability, and sovereignty of data across its lifecycle.\nThese controls govern how data is transmitted, stored,\nreplicated, and protected from unauthorized access, tampering,\nor exposure beyond defined trust perimeters.\n", + "FamilyDescription": "The Data control family ensures the confidentiality, integrity, availability, and sovereignty of data across its lifecycle. These controls govern how data is transmitted, stored, replicated, and protected from unauthorized access, tampering, or exposure beyond defined trust perimeters. ", "Section": "CCC.Core.CN14 Maintain Recent Backups", "SubSection": "", - "SubSectionObjective": "Ensure that all backups used for disaster recovery are recent and\nsubject to a retention policy that limits deletion.", + "SubSectionObjective": "Ensure that all backups used for disaster recovery are recent and subject to a retention policy that limits deletion.", "Applicability": [ "tlp-red" ], - "Recommendation": "Implement automated backup processes to ensure that backups are\ncreated regularly. Monitor backup schedules and verify that the\nmost recent backup creation date is within the last 14 days.\n", + "Recommendation": "Implement automated backup processes to ensure that backups are created regularly. Monitor backup schedules and verify that the most recent backup creation date is within the last 14 days. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -7009,14 +5027,14 @@ }, { "Id": "CCC.Core.CN03.AR01", - "Description": "When an entity attempts to modify the service through a user\ninterface, the authentication process MUST require multiple\nidentifying factors for authentication.", + "Description": "When an entity attempts to modify the service through a user interface, the authentication process MUST require multiple identifying factors for authentication.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN03 Implement Multi-factor Authentication (MFA) for Access", "SubSection": "", - "SubSectionObjective": "Ensure that all sensitive activities require two or more identity\nfactors during authentication to prevent unauthorized access.", + "SubSectionObjective": "Ensure that all sensitive activities require two or more identity factors during authentication to prevent unauthorized access.", "Applicability": [ "tlp-clear", "tlp-green", @@ -7071,14 +5089,14 @@ }, { "Id": "CCC.Core.CN03.AR02", - "Description": "When an entity attempts to modify the service through an API\nendpoint, the authentication process MUST require a credential\nsuch as an API key or token AND originate from within the trust\nperimeter.", + "Description": "When an entity attempts to modify the service through an API endpoint, the authentication process MUST require a credential such as an API key or token AND originate from within the trust perimeter.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN03 Implement Multi-factor Authentication (MFA) for Access", "SubSection": "", - "SubSectionObjective": "Ensure that all sensitive activities require two or more identity\nfactors during authentication to prevent unauthorized access.", + "SubSectionObjective": "Ensure that all sensitive activities require two or more identity factors during authentication to prevent unauthorized access.", "Applicability": [ "tlp-clear", "tlp-green", @@ -7142,14 +5160,14 @@ }, { "Id": "CCC.Core.CN03.AR03", - "Description": "When an entity attempts to view information on the service through\na user interface, the authentication process MUST require multiple\nidentifying factors from the user.", + "Description": "When an entity attempts to view information on the service through a user interface, the authentication process MUST require multiple identifying factors from the user.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN03 Implement Multi-factor Authentication (MFA) for Access", "SubSection": "", - "SubSectionObjective": "Ensure that all sensitive activities require two or more identity\nfactors during authentication to prevent unauthorized access.", + "SubSectionObjective": "Ensure that all sensitive activities require two or more identity factors during authentication to prevent unauthorized access.", "Applicability": [ "tlp-amber", "tlp-red" @@ -7202,14 +5220,14 @@ }, { "Id": "CCC.Core.CN03.AR04", - "Description": "When an entity attempts to view information on the service through\nan API endpoint, the authentication process MUST require a\ncredential such as an API key or token AND originate from within\nthe trust perimeter.", + "Description": "When an entity attempts to view information on the service through an API endpoint, the authentication process MUST require a credential such as an API key or token AND originate from within the trust perimeter.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN03 Implement Multi-factor Authentication (MFA) for Access", "SubSection": "", - "SubSectionObjective": "Ensure that all sensitive activities require two or more identity\nfactors during authentication to prevent unauthorized access.", + "SubSectionObjective": "Ensure that all sensitive activities require two or more identity factors during authentication to prevent unauthorized access.", "Applicability": [ "tlp-amber", "tlp-red" @@ -7272,14 +5290,14 @@ }, { "Id": "CCC.Core.CN05.AR01", - "Description": "When an attempt is made to modify data on the service or a child\nresource, the service MUST block requests from unauthorized\nentities.", + "Description": "When an attempt is made to modify data on the service or a child resource, the service MUST block requests from unauthorized entities.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN05 Prevent Access from Untrusted Entities", "SubSection": "", - "SubSectionObjective": "Ensure that secure access controls enforce the principle of least\nprivilege to restrict access to authorized entities from explicitly\ntrusted sources only.", + "SubSectionObjective": "Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.", "Applicability": [ "tlp-clear", "tlp-green", @@ -7351,14 +5369,14 @@ }, { "Id": "CCC.Core.CN05.AR02", - "Description": "When administrative access or configuration change is attempted on\nthe service or a child resource, the service MUST refuse requests\nfrom unauthorized entities.", + "Description": "When administrative access or configuration change is attempted on the service or a child resource, the service MUST refuse requests from unauthorized entities.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN05 Prevent Access from Untrusted Entities", "SubSection": "", - "SubSectionObjective": "Ensure that secure access controls enforce the principle of least\nprivilege to restrict access to authorized entities from explicitly\ntrusted sources only.", + "SubSectionObjective": "Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.", "Applicability": [ "tlp-clear", "tlp-green", @@ -7433,14 +5451,14 @@ }, { "Id": "CCC.Core.CN05.AR03", - "Description": "When administrative access or configuration change is attempted on\nthe service or a child resource in a multi-tenant environment, the\nservice MUST refuse requests across tenant boundaries unless the\norigin is explicitly included in a pre-approved allowlist.", + "Description": "When administrative access or configuration change is attempted on the service or a child resource in a multi-tenant environment, the service MUST refuse requests across tenant boundaries unless the origin is explicitly included in a pre-approved allowlist.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN05 Prevent Access from Untrusted Entities", "SubSection": "", - "SubSectionObjective": "Ensure that secure access controls enforce the principle of least\nprivilege to restrict access to authorized entities from explicitly\ntrusted sources only.", + "SubSectionObjective": "Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.", "Applicability": [ "tlp-clear", "tlp-green", @@ -7512,14 +5530,14 @@ }, { "Id": "CCC.Core.CN05.AR04", - "Description": "When data is requested from outside the trust perimeter, the\nservice MUST refuse requests from unauthorized entities.", + "Description": "When data is requested from outside the trust perimeter, the service MUST refuse requests from unauthorized entities.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "", "SubSection": "CCC.Core.CN05 Prevent Access from Untrusted Entities", - "SubSectionObjective": "Ensure that secure access controls enforce the principle of least\nprivilege to restrict access to authorized entities from explicitly\ntrusted sources only.", + "SubSectionObjective": "Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.", "Applicability": [ "tlp-amber", "tlp-red" @@ -7595,14 +5613,14 @@ }, { "Id": "CCC.Core.CN05.AR05", - "Description": "When any request is made from outside the trust perimeter,\nthe service MUST NOT provide any response that may indicate the\nservice exists.", + "Description": "When any request is made from outside the trust perimeter, the service MUST NOT provide any response that may indicate the service exists.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN05 Prevent Access from Untrusted Entities", "SubSection": "", - "SubSectionObjective": "Ensure that secure access controls enforce the principle of least\nprivilege to restrict access to authorized entities from explicitly\ntrusted sources only.", + "SubSectionObjective": "Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.", "Applicability": [ "tlp-red" ], @@ -7673,14 +5691,14 @@ }, { "Id": "CCC.Core.CN05.AR06", - "Description": "When any request is made to the service or a child resource, the\nservice MUST refuse requests from unauthorized entities.", + "Description": "When any request is made to the service or a child resource, the service MUST refuse requests from unauthorized entities.", "Attributes": [ { "FamilyName": "Identity and Access Management", - "FamilyDescription": "The Identity and Access Management control family ensures\nthat only trusted and authenticated entities can access\nresources. These controls establish strong authentication,\nenforce multi-factor verification, and restrict access to\napproved sources to prevent unauthorized use or data exfiltration.\n", + "FamilyDescription": "The Identity and Access Management control family ensures that only trusted and authenticated entities can access resources. These controls establish strong authentication, enforce multi-factor verification, and restrict access to approved sources to prevent unauthorized use or data exfiltration. ", "Section": "CCC.Core.CN05 Prevent Access from Untrusted Entities", "SubSection": "", - "SubSectionObjective": "Ensure that secure access controls enforce the principle of least\nprivilege to restrict access to authorized entities from explicitly\ntrusted sources only.", + "SubSectionObjective": "Ensure that secure access controls enforce the principle of least privilege to restrict access to authorized entities from explicitly trusted sources only.", "Applicability": [ "tlp-green", "tlp-amber", @@ -7757,14 +5775,14 @@ }, { "Id": "CCC.Core.CN04.AR01", - "Description": "When administrative access or configuration change is attempted on\nthe service or a child resource, the service MUST log the client\nidentity, time, and result of the attempt.", + "Description": "When administrative access or configuration change is attempted on the service or a child resource, the service MUST log the client identity, time, and result of the attempt.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "The Logging & Monitoring control family ensures that access,\nchanges, and security-relevant events are captured, monitored,\nand alerted on in order to provide visibility, support\nincident response, and meet compliance requirements.\n", + "FamilyDescription": "The Logging & Monitoring control family ensures that access, changes, and security-relevant events are captured, monitored, and alerted on in order to provide visibility, support incident response, and meet compliance requirements. ", "Section": "CCC.Core.CN04 Log All Access and Changes", "SubSection": "", - "SubSectionObjective": "Ensure that all access attempts are logged to maintain a detailed\naudit trail for security and compliance purposes.", + "SubSectionObjective": "Ensure that all access attempts are logged to maintain a detailed audit trail for security and compliance purposes.", "Applicability": [ "tlp-clear", "tlp-green", @@ -7819,14 +5837,14 @@ }, { "Id": "CCC.Core.CN04.AR02", - "Description": "When any attempt is made to modify data on the service or a child\nresource, the service MUST log the client identity, time, and\nresult of the attempt.", + "Description": "When any attempt is made to modify data on the service or a child resource, the service MUST log the client identity, time, and result of the attempt.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "The Logging & Monitoring control family ensures that access,\nchanges, and security-relevant events are captured, monitored,\nand alerted on in order to provide visibility, support\nincident response, and meet compliance requirements.\n", + "FamilyDescription": "The Logging & Monitoring control family ensures that access, changes, and security-relevant events are captured, monitored, and alerted on in order to provide visibility, support incident response, and meet compliance requirements. ", "Section": "CCC.Core.CN04 Log All Access and Changes", "SubSection": "", - "SubSectionObjective": "Ensure that all access attempts are logged to maintain a detailed\naudit trail for security and compliance purposes.", + "SubSectionObjective": "Ensure that all access attempts are logged to maintain a detailed audit trail for security and compliance purposes.", "Applicability": [ "tlp-amber", "tlp-red" @@ -7879,14 +5897,14 @@ }, { "Id": "CCC.Core.CN04.AR03", - "Description": "When any attempt is made to read data on the service or a child\nresource, the service MUST log the client identity, time, and\nresult of the attempt.", + "Description": "When any attempt is made to read data on the service or a child resource, the service MUST log the client identity, time, and result of the attempt.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "The Logging & Monitoring control family ensures that access,\nchanges, and security-relevant events are captured, monitored,\nand alerted on in order to provide visibility, support\nincident response, and meet compliance requirements.\n", + "FamilyDescription": "The Logging & Monitoring control family ensures that access, changes, and security-relevant events are captured, monitored, and alerted on in order to provide visibility, support incident response, and meet compliance requirements. ", "Section": "CCC.Core.CN04 Log All Access and Changes", "SubSection": "", - "SubSectionObjective": "Ensure that all access attempts are logged to maintain a detailed\naudit trail for security and compliance purposes.", + "SubSectionObjective": "Ensure that all access attempts are logged to maintain a detailed audit trail for security and compliance purposes.", "Applicability": [ "tlp-red" ], @@ -7938,19 +5956,19 @@ }, { "Id": "CCC.Core.CN07.AR01", - "Description": "When enumeration activities are detected, the service MUST publish\nan event to a monitored channel which includes the client\nidentity, time, and nature of the activity.", + "Description": "When enumeration activities are detected, the service MUST publish an event to a monitored channel which includes the client identity, time, and nature of the activity.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "The Logging & Monitoring control family ensures that access,\nchanges, and security-relevant events are captured, monitored,\nand alerted on in order to provide visibility, support\nincident response, and meet compliance requirements.\n", + "FamilyDescription": "The Logging & Monitoring control family ensures that access, changes, and security-relevant events are captured, monitored, and alerted on in order to provide visibility, support incident response, and meet compliance requirements. ", "Section": "CCC.Core.CN07 Alert on Unusual Enumeration Activity", "SubSection": "", - "SubSectionObjective": "Ensure that logs and associated alerts are generated when\nunusual enumeration activity is detected that may indicate\nreconnaissance activities.", + "SubSectionObjective": "Ensure that logs and associated alerts are generated when unusual enumeration activity is detected that may indicate reconnaissance activities.", "Applicability": [ "tlp-amber", "tlp-red" ], - "Recommendation": "Implement event publication mechanisms and alerts for patterns\nindicative of enumeration activities, such as repeated access\nattempts, requests, or liveness probes. Configure alerts to notify\nsecurity teams of any activities that merit further investigation.\n", + "Recommendation": "Implement event publication mechanisms and alerts for patterns indicative of enumeration activities, such as repeated access attempts, requests, or liveness probes. Configure alerts to notify security teams of any activities that merit further investigation. ", "SectionThreatMappings": [ { "ReferenceId": "CCC", @@ -7996,21 +6014,21 @@ }, { "Id": "CCC.Core.CN07.AR02", - "Description": "When enumeration activities are detected, the service MUST log the\nclient identity, time, and nature of the activity.", + "Description": "When enumeration activities are detected, the service MUST log the client identity, time, and nature of the activity.", "Attributes": [ { "FamilyName": "Logging & Monitoring", - "FamilyDescription": "The Logging & Monitoring control family ensures that access,\nchanges, and security-relevant events are captured, monitored,\nand alerted on in order to provide visibility, support\nincident response, and meet compliance requirements.\n", + "FamilyDescription": "The Logging & Monitoring control family ensures that access, changes, and security-relevant events are captured, monitored, and alerted on in order to provide visibility, support incident response, and meet compliance requirements. ", "Section": "CCC.Core.CN07 Alert on Unusual Enumeration Activity", "SubSection": "", - "SubSectionObjective": "Ensure that logs and associated alerts are generated when\nunusual enumeration activity is detected that may indicate\nreconnaissance activities.", + "SubSectionObjective": "Ensure that logs and associated alerts are generated when unusual enumeration activity is detected that may indicate reconnaissance activities.", "Applicability": [ "tlp-clear", "tlp-green", "tlp-amber", "tlp-red" ], - "Recommendation": "Implement logging mechanisms to capture details of enumeration\nactivities, including client identity, timestamps, and activity\nnature. Retain logs according to organizational policies, and\noccasionally review them for patterns that may indicate\nreconnaissance activities.\n", + "Recommendation": "Implement logging mechanisms to capture details of enumeration activities, including client identity, timestamps, and activity nature. Retain logs according to organizational policies, and occasionally review them for patterns that may indicate reconnaissance activities. ", "SectionThreatMappings": [ { "ReferenceId": "CCC",